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TECHNICAL PAPER 


A HISTORY OF AEROSPACE PROBLEMS, THEIR SOLUTIONS, THEIR LESSONS 

I. INTRODUCTION 


The author, along with the support of the Structures and Dynamics Laboratory, has made a major 
thrust to develop criteria, design guidelines, and “lessons learned” as a part of an effort to provide 
mentorship and to transfer knowledge to new NASA employees. A study of the problems experienced is 
a part of that effort. These criteria and guidelines should not become the layering of old laws or addi- 
tional laws to protect against a failure or problems experienced, but should be overarching principles and 
guidelines that allow for creativity, innovation, and accountability by each and every member of a 
design and operations group. The study of problems serves as a basis for developing these high-level 
principles that guide the development of future programs. Problem study is not to be the negative finger 
pointing “look what you have done wrong,” but the beacon to illuminate “what to know and understand 
in order to build low-cost, robust aerospace systems of the future.” 

This paper is an attempt to establish part of this needed knowledge foundation. It is based on 
many years of experience in both the early and present years of space exploration. This study is an 
expansion of information published in references 1, 2, 3, and 4. It is presented with the faith that some 
will be challenged to launch out into the deep. Only to the degree that the individuals of the aerospace 
community launch out into the depth of their specialties, yet maintain a bend toward being a generalist, 
an integrator, or a systemist, will the technology of the future aerospace (and possibly our Nation’s) be 
served. 


The information presented has many sources. Much of it was developed by the various vehicle or 
spacecraft contractors. The information was obtained in general from briefings; however, some came 
from reports and papers (see reference list). The remainder of the information was produced by NASA 
engineers as they performed their tasks of managing the various project contracts, or conducting 
research and technology development. Given the vast scope of this paper, it is impossible to credit all 
the individuals who contributed; however, it is they, and not the author, who did the work, had the 
insight, solved the problems. The author’s task has been to collect the information and draw lessons 
from it. The author has been involved in all the projects presented, as well as most of the specific 
problems discussed. Therefore, the selection is generally limited to the author’s experiences and does 
not cover all NASA or Department of Defense (DOD) aerospace experience. In addition, the solutions 
set forth do not cover all the many disciplines of any given project. 

The format used is first a discussion of the characteristics of each project, followed by a dis- 
cussion of the technology development/creativity and innovation brought to bear as a result of design 
challenges and problems, along with highlights of key problems. This portion of the report is, therefore, 
a summary providing the reader with insight without the details. Second, the appendix contains a 
detailed listing of all problems/documents and a discussion of problems not previously documented. A 
selected few of previously documented major problems are included for completeness. 

The approach for applying the study of problems to current projects is straightforward, but 
important. First, study the documented history of problems, their solutions, facilities, technology, and 
the resulting knowledge (theory, knowledge, guidelines) to understand the physics of the problem and 
the solution approach. Second, tailor the results to the individual project under consideration. A natural 
outcome of this tailoring is the further development and enhancement of models, simulations, test 
facilities, etc., that are keys to good design and are the basis for solving the complex problems that 
develop during the new product’s design and operation. The importance of having this knowledge, these 
tools, and facilities going into a new product cannot be overstated. Numerous examples can be given 



where the program would have been canceled had not these technologies, tools, skills, and facilities 
existed. The advanced turbopump design (ATD) liquid oxygen (lox) pump for the space shuttle main 
engine (SSME) is a classic example. In this case, a deadline was given for the solution of the bearing 
wear problem or the program would be canceled. The skills of Govemment/industry/universities 
assuming a concurrent engineering team, the MSFC flow facilities, Pratt & Whitney’s E-8 test stand and 
manufacturing unit, and the silicon nitride ball bearing technology developed at MSFC, were the con- 
tributing factors that ensured a solution in time to save the program. Future programs, therefore, require 
from the past and present: 

- Human skills and knowledge 

- Tools (analytical and computational) 

- Facilities 

- Enabling technologies. 

From these come knowledge and design guidelines, etc., that serve as the foundation of future programs. 

I would like to thank all who have helped pull together the information contained in this report. 
Each of the laboratory’s project lead engineers put together the problem matrixes. Others have provided 
lessons learned and other key comments. I would like to thank Karen Spanner for a significant effort in 
pulling together the SSME flight readiness review data base and write-ups of some of the key SSME 
problems. Werhner Dahm and Harold Scofield made significant contributions to the sections on innova- 
tions and creativity. 


II. GENERAL 


A. Why Study Problems 

The study of problems and their solutions is the foundation of the success of future space pro- 
grams. The design and operation of these space programs are very complex and challenging, pushing the 
state of the art. They are made up of space vehicles, spacecraft, payloads, manufacturing facilities, and 
operations facilities (including communication systems) that continuously push state-of-the-art technol- 
ogy in engineering, management, and leadership. The systems being developed are highly tuned, 
balanced between competing requirements. This is true whether one is designing a turbopump, balanc- 
ing the hydro output (pressure, flow) with vibration, stability, life, weight, and cost, or a launch vehicle’s 
performance versus operational robustness, cost, schedule, etc. In general, these systems are high- 
performance driven, which leads to a “high-q” system (sensitive to small changes and highly tuned). 

The role that problem analysis/study plays in a products success depends on the time phase the 
product is in. An excellent discussion of product time phasing by Utterback is in “The Dynamics of 
Innovation” in reference 5. There are two major observations in the book. The first has to do with shift- 
ing of emphasis from the product development (technology) to the process (fig 1). The second deals 
with the impacts of the invading radical, innovative technologies on the established products 
(fig. 2). Invading technologies cause the established product to accomplish bursts of improvement to 
counteract the invasion. For a period of time, this works; however, if the invading technologies are 
strong, they can win out and replace the product. As figure 2 indicates, parallel with this development is 
the shift from a technology to a process improvement and product standardization. As the product life is 
in its early phase where technology development/implementation is the focus, problem history and 
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Product 

From high variety, to dominant design, to 
icremental innovation on standardized 
products 

Process 

Manufacturing progresses from heavy 
reliance on skilled labor and general-purpose 
equipment to specialized equipment tended 
by low-skilled labor 

Organization 

From entrepreneurial organic firm to 
hierarchial mechanistic firm with defined 
tasks and procedures and few rewards for 
radical innovation 

Market 

From fragmented and unstable with diverse 
products and rapid feedback to commodity-like 
with largelyundifferentiated products 

Competition 

From many small firms with unique products to 
an obligopoly of firms with similiar products 


Figure 1 . The dynamics of innovation. 



Figure 2. Performance of an established and an invading product (burst of improvement 

in established product). 
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understanding is very important, as it guides the technology development focus, including the deter- 
mination of the technologies and systems needs. The problems experienced in past programs drive the 
technology program. The process of moving a product into an established phase requires technology 
focus by leadership and managers in order to understand problems, their source, their systems impacts, 
and the final product. As the product moves into the process-controlled phase, the emphasis is on fine 
tuning the technology/processes to achieve better operations, higher reliability, and lower cost. This 
process focus of leadership must be keenly aware of problem prevention. Problem history plays a major 
role also in this problem prevention of the product. The transition period between technology focus and 
process focus is also very critical in that during this time the product either makes it, or it does not. The 
role of problem history analysis here is clear. 

Space exploration is certainly in the transition period where much of the products technology is 
at the standardized phase. This means that the emphasis is shifting to the process focus with cost, opera- 
tions, and reliability playing key roles, yet space exploration requires high performance. High- 
performance systems require attention and care or problems erode the gain required for cost and opera- 
tional efficiency. In order to maintain the high performance/low cost, new technologies must be 
developed to meet these goals. 

Thinking about this product evolution and the role problem analysis/history plays, a key inter- 
relationship emerges, that is required to solve development, operating, and new technologies inclusion. 
The key interrelationships are, in general, between people development (learning organization), tool 
development (facilities are included here), and technology development. Senge, in “The Fifth 
Discipline,” 6 makes two observations. First, it is the tendency of a team to perform at the level of the 
member with the lowest IQ (i.e., skills); and second, with proper leadership and synergy, the team can 
perform higher than the member with the highest IQ (skills). The conclusion is that people skills, both 
technical and leadership, must be constantly developed. Style of organizational leadership starts at the 
top, technical leadership starts at the bottom. First line supervisors must necessarily be style and 
technical leaders. Style without technology is like an English teacher who writes eloquently but has 
nothing to say. Most of the time this learning is best accomplished by working and developing 
technology options first during the product emerging phase and then during the sustaining process 
controlled phase. It is also clear that if this second leg, technology, is not developed parallel with the 
product development, a time will come when the product will be lost without supporting technological 
solutions. The third interrelationship leg is tool development and maintenance. The tool leg is 
multifaceted, covering analysis, testing, information networks, facilities, and management. There are 
numerous examples in space exploration when simultaneous existing of these three legs saved a program 
(product). Figure 3 tries to symbolically capture these relationship organizational characteristics. The 
bottom line is that the organization must have two parallel emphases. One works on fine tuning, 
improving the current product. The second explores new technologies that can drastically alter the 
product to accomplish the task. For example, the typewriter replaced by the computer word processor. 
These, in general, are two specific groups of people who are not competing but working different roles. 
Space exploration must follow this path. 

How does this relate to the study of problem history/analysis? Problem history/analysis plays at 
least two major roles. (1) It serves as a source of knowledge that relates in a way no academic process 
can, showing the depth and subtleties of a problem and system interactions/sensitivities. (2) It provides 
the road map/information for developing the technology gap analysis and, thus, the priorities and pro- 
grams that develop the supporting technologies. Clearly, it could help to identify the competing tech- 
nologies and to provide the basis for a product shift; however, history has shown that the competing 
technologies usually emerge from the outside. 

Complications also arise because of the U.S. funding approach. Many problems are introduced as 
a result. Predominating is the stretching of funds and schedules that transfers issues from design to 
operations, greatly increasing operations cost and decreasing flexibility, etc. This means that the design 
in the end is always a balance between the multitude of conflicting parameters and requirements. 
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Figure 3. The organizational requirement for product success. 

Gordon, in “Structures,” says: “All structures will be broken or destroyed in the end. Just as all people 
will die in the end. It is the purpose of medicine and engineering to postpone these occurrences for a 
decent interval; the question is: what is to be regarded as a decent interval.” ' 

Pye, in “The Nature of Design,” 8 discusses the source of problems and these compromises. He 
talks about the source of problems dealing with the manifestation and transfer of energy. He says: “Any 
of these forms of energy is capable of producing changes, changes in things; more exactly, redistribution 
of matter. . . Now whenever a change is made by the passage of energy and a result is left, this event 
takes place in a group of things. Things are always together. They do not exist separately and they can- 
not act separately. . . When you put energy into a system you can never choose what kind of changes 
shall take place and what kind of results shall remain. . . All you can do, and that only within limits, is to 
regulate the amounts of the various changes. This you do by design.” He talks about the compromises in 
the design for failures. “The requirements for design conflict and cannot be reconciled. All designs for 
devices are in some degree failures. . . The designer or his client has to choose to what degree and where 
these shall be failures . . . .” 

Pugh, in “Total Design,” 9 discusses in detail how the design problem is approached. He sepa- 
rates the task into parts where the concept selection and the design activities are the lynch pins of 
success. He states that outstanding design engineering can never right the shortcomings of poor concept 
selection, while the best concept selection can be destroyed by poor design engineering. 
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Petroski, in his book “Design Paradigms,” 10 relates that design usually starts to analyze a 
problem in the middle based on past experiences and scaling, forgetting to start at the beginning. “Every 
solution of every design problem begins, no matter how tacitly, with a conception of how to obviate 
failure in all its potential manifestations.” He further discusses how changes are made without consid- 
ering other effects that solving the immediate problem creates. Any design change can introduce new 
failure modes or bring into play latent failure modes. Changes must be analyzed with the objective of the 
original design, including all potential failure modes. Senge, in his notable work on systems, 6 says that 
“If any small change is made to a system, the whole system must adjust to that change.” 

As space exploration progresses into the future, the compromises will, in all likelihood, be mag- 
nified. Design of these systems will be based on processes that include much of what is embodied in the 
principles of total quality management (TQM), concurrent engineering, or their equivalent. This means 
not only a change in attitude, leadership, management, but also a change in methods such as the applica- 
tion of quality function deployment (QFD), 11 Taguchi, 12 robust design, 13 simultaneous engineering, 14 
and just-in-time manufacturing. 15 The key is the change in management and leadership, the others are 
merely tools to help the process. The challenge of the future, plus the promise of these new attitudes, 
new leadership, tools, and principles, creates excitement and interest as well as challenge and motiva- 
tion. It should be seared into one’s mind, however, that the design can be no better than the knowledge 
and skills of the people brought to these systems. No organizational structures, tools, or facilities can 
supplant that. This means that even with concurrent engineering teams, TQM, etc., the team membership 
is critical, as well as both the team and institutional leadership. Leadership serves at least two functions: 
(1) to bring out the best creativity, knowledge, and design the team is capable of; and (2) to lead institu- 
tional setting of mission/vision, not the least of which is the development of the “total person” of every 
employee. Therefore, training and development of the key resource people is the answer. The strategic 
bomb of the future is the leveraging of knowledge. Aerospace and aeronautical engineering has the edge 
here. 


Deming, the “guru” of quality, emphasizes that knowledge and theory are key ingredients to a 
better product. “You cannot see anything without knowledge . . . need theory to interpret data and learn 
. . . cannot observe what is right or wrong without theory and knowledge . . . what organizations need is 
not just good people, but people who are improving with education . . . knowledge increased advances in 
competitive positions have their roots in knowledge . . . theory is the basis for interpreting data, etc., and 
is the foundation of an organization . . . there is no substitute for knowledge of the system . . . tampering 
without knowledge creates problems (PS solving).” 16 

Drucker says in reference 17, “Management is about human beings. Its task is to make people 
capable of joint performance, to make their strengths effective and their weaknesses irrelevant. Man- 
agement must also enable the enterprise and each of its members to grow and develop as needs and 
opportunity change. Every enterprise is a learning and teaching institution. Training and development 
must be built in on all levels . . . training and development that never stops,” 

Depree writes in reference 18, “Leaders owe people space, space in the sense of freedom. 
Freedom in the sense of enabling our gifts to be exercised. We need to give each other the space to 
grow, to be ourselves, to exercise our diversity.” 

As a project unfolds from concept through development, problems develop during the design, the 
development, and the operations of space systems. These problems have both a real-time and a long- 
term effect. Many times, in fact most of the time, analysis techniques and tools, testing techniques and 
tools, materials development and characterization, and manufacturing techniques and tools are not ade- 
quate to understand and solve the problem. Large efforts are expended to expand these technologies, 
understand the problems, and design fixes so that a successful program occurs. The next program 
assumes this same complexity, building more tools, criteria, and requirements instead of simplicity and 

robustness. We need to use this technology to emphasize robustness in the future systems. 19 One of the 
most interesting aspects of the evolving culture (still present in aerospace engineering) was the 
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innovation/creativity engineers brought to the understanding and solution to problems that occur. This 
was particularly true before high-speed, large -capacity computers, when they could not brute force the 
computational analysis, but had to rely on sound physical principle and innovative ways of dealing with 
the problems. Numerous examples of creativity and innovation will be given throughout the paper. 

As was discussed in other reports and papers by the author, because of high-performance 
requirements and programmatic constraints, the design, development, and implementation of these 
requirements have led to many development and operations problems. In addition, operational costs 
have sky-rocketed as decisions were pushed downstream. The question that arises is: “is the high cost 
due to major design process errors?” Probably not in the early days, since space was a complex evolving 
technology. Space exploration by its nature involves risks, costs, failures, etc. However, the industry has 
matured to the point where things can be done to reduce (not eliminate) costs. A better approach would 
consider all cost/program phases concurrently in order to reduce total cost. Figure 4 illustrates this 
concept that should be striven for. 



Figure 4. Systems approach. 

Looking back at the history of aerospace, the evolution of the technologies commensurate with 
the evolution of space systems is apparent. Electronics have made quantum jumps in capability increase, 
size reduction, and reliability. Materials have evolved with high strength, fracture toughness, etc.. Manu- 
facturing has made major advances through castings, composites, robotics etc. Structural analysis has 
moved from equivalent beam modal analysis to finite element models augmented by substructuring and 
modal coupling techniques. Computational fluid dynamics (CFD) and computational mechanics (CM) 
was necessary to solve complex flow and structural problems. Cross-discipline-integrated analysis tools 
have evolved, as well as have complex probabilistic approaches for controlling quality and assessing 
reliability. Fatigue and fracture control has made quantum jumps, as have thermal heat transfer analysis, 
pointing control techniques, structural control interaction, smart structures, and induced environment 
definitions. Criteria and standards have followed (in many cases becoming excessive and over con- 
straining). Testing techniques from modal, vibration, electrical, thermal vacuum, flow, and aero- 
dynamics have kept pace with many unique facilities developed. In the individual project sections, 
portions of this development will be discussed. As any new project moves through the development 
phase, new problems will occur. How these occurrences are handled determines success or failure. The 
tool that has evolved for coping with failures/problems is the use of concurrent engineering teams. Using 
formalized fault trees, logic diagrams, and action item closure has proven best. 9 21 22 The authors have 
been members or leaders of several of these failure teams and can attest to the merits of the approach. It 
and the use of failure effects modes analysis (FEMA) in design are two common-sense innovations 
growing out of space exploration, and should be the working knowledge of every engineer. 
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Not only have engineers been innovative in solving technical problems, their innovation and 
creativity has taken many forms. It behooves management, as well as engineers, to utilize and enhance 
all these various expressions. The major one obviously is the innovative and creative engineering 
solutions just discussed and will comprise much of the rest of this report; however, the other expressions 
of creativity not only add humor but are many times better forms of communication than our formal, 
logical, analytical, scientific formats. To be associated with these expressive, atypical engineers who 
choose to use humor or descriptive titles and acronyms is one of the great highlights of our careers. Rich 
Holmen at McDonnell Douglas used humor through cartoons to capture personalities as well as 
engineering concepts during the Apollo and Skylab projects. McDonnell Douglas published some of 
them in a booklet titled “The First Five Years Are the Hardest or It Only Hurts At Resonance,” nicely 
drawn by Rich Holmen. The cartoon (fig. 5), “It Only Hurts at Resonance,” captures a problem we had 
on the Saturn rocket third stages (SIV B), as well as all subsequent projects in dynamics and control in a 
way we cannot forget. With dynamic resonances, you either understand and solve them or the price is 
very high. Design compromises to solve problems are a constant struggle. Holman’s cartoon (fig. 6) 
shows a design complication in order to get rid of a feedback pot, pictorially giving us the message. 

In the Saturn Apollo days, Honeywell published yearly calendars with Bill Eddy’s cartoons 
highlighting each month. There are two bound books of these cartoons, which are not only humorous but 
give great messages in unforgettable ways. Two of my favorites deal with specifications (fig. 7) and 
accuracy (fig. 8). “So that decimal point was a fly speck!” brings home a poignant point, as did all the 
other calendars that not only made us better engineers technically, but also made us laugh a little, which 
relieved work pressures. Remember, each of these lessons was displayed on our office walls for a whole 
month, speaking to us. Then came the next month. Today we see planes, ships, electronics, etc., trying to 
sell us on a product. 

The other area of creativity that could be either humorous or illustrative, or both, has been the 
naming of parts or acronyms. Figure 9 lists a few selected for illustration. In general, the name either 
describes the geometry or the physical characteristics of the phenomenon. The rest of the creative illus- 
trations of this paper will deal with the creative engineering contributions made while addressing major 
design problems. 
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Figure 6. Design compromises. 
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Figure 8. Change in what specs? 


Lessons in Propulsion System 
Design 

SSME Buzz Words 

• “Steerhorn"- Nozzle down comers 

• “Baby pants"-- Heat exchanger bifurcation joint 

• “Sea world”-- EDNI deposit bath for MCC's 

• “Ski slope”- HPOTP turbine end 

• “Pop"- Type of engine detonation in oxidizer and fuel preburner 

• “Fir tree”- Region of disk which blades are mounted, also region at base of blades 

• “Kaiser hat”-- HP FTP turbine end entrance to turbine blades 

• “Pony foot”-- Bottom of down comers 

• “Coolie hat”- HPOTP turbine end 

• “Band weld”- Nozzle jacket repair (EDNI) 

• “Fish mouth”- Seals in the pump 

• “Fish mouth”- Repair of the nozzle hot wall coolant tubes 

• “Mixture bowl”- Nozzle 

• “Hot dog”- Lox inlet manifold for lox dome 

• “FRI”- Flow restriction inhibitor for G15 seal 

• “Turnaround duct”- HPFTP turbine exit duct 

• “Belly band”- MCC throat shell 

• “Pogo”- Longitudinal vehicle oscillation due to propulsion system coupling 

• “DOLIU”- Day of launch l-loads update 

• “Hex”- Heat exchanger 

• “T-bolts”- Bolts to hold shields on lox post 

• “Whirl”- Rotary instability in turbo machinery 

• “Z-baffle”- Baffle in pogo accumulator 

• “Buzz”-- High frequency vibration in SSME system 

• “Beer cans”- Jupiter anti-slosh devices 

• “Crossbow seal"- Seal in SSME turbo pumps 

• “Grub worm”- External Tank to launch vehicle connection 


Figure 9. SSME “buzz” words. 
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B. Classification of Problems 

Space vehicles and spacecraft are very complex; many are one of a kind. This complexity and 
uniqueness produces a variety of problems that occur during development and operations. Many of these 
problems have been published in technical papers or failure reports, with some given at professional 
conferences. Design reviews and flight readiness reviews also contain many examples. Reusability 
further complicates the design concerns; therefore, vehicles such as the space shuttle not only had devel- 
opment problems, but must deal with lifetime, maintenance, and operations problems that occur because 
of lifetime issues and other factors. 2 In attempting to summarize all these different problem sources, 
taking into account the project individual characteristics, it was decided to group the problems by project 
instead of by problem cause, as was done in reference 1 . The problem causes or manifestations can be 
generally classified as one of the following: 

1 . Aeroelasticity 

2. Instabilities (control, flow, structural, Pogo, etc.) 

3. Fatigue, fracture mechanics, and wear 

4. Environments (winds, contamination, temperature, etc.) 

a. Natural 

b. Induced 

5. Response (forced and transient) 

6. Modeling discrepancies 

7. Acoustical tuning 

8. Structural, control, fluid, modal tuning 

9. Manufacturing/quality (process control), 

10. Procedures. 

The projects covered are: 

1. Saturn Apollo, Saturn V Apollo 

2. Sky lab 

3. Titan Viking 

4. Jupiter — military and aerospace 

5. Redstone — military and aerospace 

6. Space shuttle 

a. External tank (ET) 
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b. Solid rocket booster/solid rocket motor (SRB/SRM) 

c. Advanced solid rocket booster/advanced solid rocket motor (ASRB/ASRM) 

d. SSME 

1. Baselining 

2. ATD 

7. Hubble Space Telescope (HST) 

8. Tether Satellite System (TSS) 

9. High Energy Astro Observatory (HEAO) 

10. Spacelab 

a. Multipurpose Experiment Support Structure (MPESS) 

b. Office of Space Technology Applications Experiment No. 1 (OSTA-1) 

c. Spacelab- 1 

d. Spacelab-2 

e. Spacelab-3 

f. D-l 

g. Astro- 1 

h. Office of Aeronautics and Space Technology Experiment No. 1 (OAST-1) 

I Orbiting Materials Science Laboratory Experiment No. 1 (OMSL-1) 

11. Upper stages 

a. Inertial upper stage (IUS) 

b. Transfer orbit stage (TOS) 

12. Advanced X-Ray Astrophysics Facility (AXAF) 

a. AXAF-I 

b. AXAF-S 

13. Space Station Freedom (S.S. Freedom ) 

14. National Launch System (NLS) 

15. Furnaces (experiments) 
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16. IPS 


17. Burst and Transient Source Experiment (BATSE). 


C. Pictorial of Problems 

1. Pictorial of Projects . NASA has had an evolution of projects since its inception in 1959. 
MSFC has been involved in most of these efforts. Figure 10 shows the Marshall project involvement, 
while figure 1 1 depicts the project evolution. Marshall’s experience base involves science, upper stages, 
satellites, tethers, launch vehicles, propulsions systems, telescopes, manned stations, etc. These are 
encompassed by the outline given in section B. In the following sections, more information will be given 
on each of the projects. 

2. Problem List . The appendix lists, by project and title, the various problems collected and 
studied. This should serve as a handy reference. Not all problems listed will be summarized and 
discussed in this document because they were documented in references 1 through 4. Some will be 
repeated in order to provide continuity and clarity. 

It should be pointed out that not all problems, which are important to study and become lessons 
learned for the development phases, are failures. Many were discovered in the analytical and trade 
phases. In fact, it is better to find them in these phases and thus design out the problem. Some problems 
of this type are included. Also, the process of design provides lessons in terms of philosophy, 
approaches, and criteria inherent in successful projects. In general, it is left to the reader to develop his 
or her own list in these categories. 


III. AEROSPACE PROJECT/PROGRAM DEVELOPMENT 


A. Redstone and Jupiter 

1 . Characteristics . The Redstone was a military vehicle designed to deliver a nuclear warhead 
200 mi downrange. It burned kerosene and lox and was designed to be a significant improvement over 
the German rocket V-2 technology, yet was basically a derivative of the V-2 designed by the German 
team transported to the United States after World War II. Dr. Wemher von Braun was the famed leader 
of this team, which contributed greatly to the U.S. Moon race by developing the Saturn launch vehicle. 
The airframe was integral with the propellant tanks. Figures 12a and 12b are pictures of the basic vehicle 
showing its general characteristics. Control was accomplished using jet vanes in the thrust exhaust 
stream, augmented with movable fins or rudders during the aerodynamic portion of flight. 

The basic vehicle was modified to accept an upper stage for launching the first U.S. satellite, and 
later, to launch man in a lob flight as a part of the Mercury program. This program was called the 
Mercury Redstone. Also, this vehicle, in a flight testing reentry nose cone, launched a nose cone over 
3,000 mi downrange. This launch created a furor and led to the Army being restricted to 200-mi 
vehicles. Therefore, the vehicle was very robust and successful. 

The Jupiter was an intermediate range ballistic missile (IRBM) designed to deliver a warhead to 
a target 200 mi away. Figure 13 shows the basic vehicle and its characteristics. The Air Force developed 
comparable vehicles, namely Thor and Atlas. The Jupiter was modified and flew several satellite 
missions under the code name Juno. The technology of the Redstone and Jupiter was combined to build 
the first Saturn vehicles, which is discussed in the next chapter. Propulsion, tankage, tooling, etc., was 
adapted to the Saturn I and EB vehicles. 
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Figure 10. Heritage. 


LESSONS IN PROPULSION SYSTEM DESIGN 
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Figure 11. Project evolution. 












Figure 12a. V-2 configuration. 
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Figure 12b. Redstone configuration. 
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Figure 13. Jupiter configuration. 


2. Evolution/Creativitv/Innovation . During the Jupiter and Redstone programs, there was a 
struggle/trade of how best to deal with aerodynamically unstable missile systems, including performance 
loss due to winds, guidance, and loads. The aerodynamic stability question could be solved by putting 
large static aerodynamic fins on the aft end, and optimizing the external shapes and mass distributions 
(propellant tank locations). In many cases, the fins were too large, thus thrust vectoring was brought into 
play along with movable fins. In the case of the Redstone, movable vanes were put into the thrust 
stream. The Jupiter vehicle gimbaled the nozzle, driving the design of the gimbaling thrust bearing and 
actuation system. There were still the performance, guidance, control, and loads problems associate with 
the winds/aerodynamics-induced drift and loads. 




Wemer K. Dahm, whose experience spans the German V-2 through the present, provides his 
assessment of this area of development in the following sections. 

Control Development of Rocket Vehicles : 

a. During the time of the V-2 (World War II in Germany) and Redstone (figs. 12a and 12b) 
(after World War II in the United States), the control technology could neither cope with aerodynamic- 
ally unstable vehicles, nor with aerodynamically unstable control surfaces. The vehicle had to be stabil- 
ized with fins of sufficient size to keep the center of pressure behind the center of gravity at all times, 
and the center of pressure of control surfaces had to be downstream of the hinge line. Primary control 
was exerted by jet vanes (aerodynamic controls require dynamic pressure to be effective, and are thus 
useless near lift-off and cut-off). Jet vane size had to be minimized to reduce the thrust loss from their 
drag. In addition, jet vanes are close to the single-engine-vehicle’s longitudinal axis and provide only 
weak roll control. The effect of side winds on the fins creates “rolling-moments-due-to-combined-pitch- 
and-yaw” proportional to the dynamic pressure. The jet vanes could not overcome these moments. 
Therefore, aerodynamic control vanes were added at the fin tips of both missiles. These vanes were cou- 
pled with the jet vanes, and were driven by the same actuators. The Redstone had about the same range 
and payload weight as the V-2. However, the payload was a nuclear bomb, and the circular probable 
impact error was reduced to 450 m through terminal guidance of the separated entry body, i.e., the 
biconical nose of the missile. The circular probable error of the V-2 was about 10 times as large. The 
terminal guidance required: 

(1) Attitude control during the exoatmospheric flight of the separated warhead, to keep the con- 
trol gyros from hitting their stops and losing their alignment. This control was accomplished 
with cold gas control jets located at the roots of the warhead air vanes. The jet controls were 
hard-coupled with the air vanes. 

(2) An aerodynamic design of the warhead and its air vanes for minimum center of pressure shift 
with Mach number, in order to minimize control system size and weight. This had to be 
accomplished on paper, and methods for this had to be developed along the way, since super- 
sonic wind tunnels were not operational during the initial years of the Redstone design. The 
first warhead test data became available about 4 months before the first Redstone launch 
(August 20, 1953). The paper design was successful; no design changes were subsequently 
required. 

The Redstone was really two missiles. The initial version, dubbed the “Experimental Redstone,” was 
designed for a large, spherical payload; its design started in early 1951. In 1953, that payload was 
replaced by a more slender, cylindrical shape, which forced a redesign of the warhead and led to the 
“Tactical Redstone.” That vehicle was eventually deployed in the field. 

b. Hermes II: First Attempt to Fly an Unstable Launch Vehicle . The Hermes II project of the late 
1940’s was supposed to test fly a wing ramjet vehicle at Mach 2.7 and an altitude of about 30 km. The 
vehicle was a modified V-2. The tip up to the aft end of the instrument compartment was converted to a 
second stage, with a large wing ramjet, a pitch control canard, and two vertical control vanes at the rear 
end for lateral and roll control. In spite of the enlarged tail fins, the large ramjet wing rendered the 
launch configuration unstable. An accelerometer control was supposed to stabilize the vehicle. That 
control system worked well in bench tests, but failed in flight because the mechanical vibrations of the 
vehicle structure swarmed the accelerometer. The vehicle lost control somewhat into the flight. The 
launch took place at White Sands. Due to the severe limitations of the telemetry of that time, the flight 
vibration environment was largely unknown. The Hermes II project was canceled in early 1950. 
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c. Jupiter. IRBM. etc.: Swivel Engine Control of Unstable Vehicles . By about 1955, when the 
design of the Jupiter and Thor IRBM’s and the Atlas and Titan Intercontinental Ballistic Missiles 
(ICBM’s) began (all having the common Atlas developed engine), the propulsion community had 
managed to design swivel engines for thrust vector control. This powerful control authority, together 
with advances in control technology, permitted us to design and fly aerodynamically unstable missile 
configurations. Fins could by and large be abandoned. Jupiter became a simple blunt cone-cylinder 
body; the forward part of the cone was the reentry body, with the rear part being the instrument 
compartment. The control system included four cylindrical angle-of-attack meters sticking out from the 
surface of the instrument compartment, two each in the pitch and yaw planes. They compensated for the 
instability of the basic configuration. The system was successful and reliable. Jupiter roll control was 
accomplished by using the thrust of the engine’s turbine exhaust, discharged through a swiveling pipe 
knee at the flank of the engine compartment. 

The first breakthrough was the development of a drift minimum control logic that balanced the 
system between control, guidance, and performance in terms of a rigid-body system. This did not solve 
the induced loads problem. A rigid-body load relief scheme was developed that required schemes to 
sense the induced angle of attack. During these programs, two approaches were used. (1) Small vanes on 
the vehicle nose that turned to follow the aerodynamically induced flow were used, with transducers to 
measure the angular deflection. (2) Delta pressure sensors were placed on each axis of each side of the 
vehicle to provide a means of detecting angle of attack. In order to really work these issues, a good 
understanding of the atmospheric winds and density was required. The Air Force and the Army started 
programs to measure these atmospheric characteristics, requiring development of sensing systems, data 
evaluation, and modeling technologies. 

Liquid propellant sloshing became a problem due to the loss of the second Jupiter vehicle. 
Analytical and experimental data and approaches were not available to characterize the problem. The 
first attempt was to place the full-size propellant tank on a railroad car then bump it against the rail end 
stop as an excitation mechanism. In terms of today’s standards, this was not a well-controlled experi- 
ment. Large perforated cylinders with sealed spheres (commode floats) were floated in the tank and 
again tested, showing their good damping characteristics. The next Jupiter was flown successfully using 
this system. New technologies resulted as the program moved forward: 

1 . Analytical representation of fluid dynamic characteristics 

2. Equivalent mechanical analog of the complex analytical equations (pendulum or mass spring 
slosh model) 

3. Scale model testing techniques, instrumentation, and data evaluation 

4. Development of slosh baffles that became an integral part of the structural stiffening ring, 
saving weight over the floating (beer) cans. 

Because the warheads (payloads) had to reenter the Earth’s atmosphere at very high speeds, 
aerodynamic heating and protection against it were major technology developments. During this time, 
the ablative protection attached to the structural metal was developed, verified, and used, and serves as a 
base technology for many future systems. 

Plume heating of the vehicle base, both convection and radiation, was an additional technology 
issue. The first Jupiter was destroyed due to plume heating that destroyed the control wires, thus causing 
it to lose attitude control. Two technologies had to be developed and verified: (1) environment 
prediction, and (2) protection/control of environment. 

Structural dynamic testing of the full Jupiter vehicle was attempted, but was not very successful 
due to improper boundary conditions (suspension systems); however, this served as a solid foundation 
for testing technology developed for Saturn. 
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During the Jupiter development, the interaction between the thrust vector control (TVC) servos 
and the second bending mode was a major effort. The potential problem was brought home in force on 
the first flight and subsequently fixed. 

According to Harold Scofield, “Some people were never convinced that the second Jupiter lost 
was due to sloshing. We had only primitive models before the loss in flight. It is difficult to make 
definitive conclusions without some good analytical models. This problem (lack of definitive models) is 
still with us in some areas today, thus, exists the dependency on test data alone for those areas where 
modeling is inaccurate. The lessons keep repeating. We must pay attention to history or repeat it. 
Theories and analysis are always needed whereby to interpret the test and flight data.” 

All of this was done with very little computational capability, which points out the innovation 
and practicality of the engineers in dealing with complex technologies. Those were the days of slide 
rules and Marchant and Frieden desk calculators. 

As was mentioned previously, graphite jet vanes were used in the combustion gas stream (thrust 
stream) to control the thrust stream and thus the vehicle. However, severe erosion limited its effective 
control duration. This led to gimbaling the thrust chamber. Gimbaling the thrust chamber with the high- 
pressure ducts from the pumps input very large actuator loads and short duct life. This led to gimbaling 
the entire engine with the pumps attached to the engine. Balanced bellow ducts were incorporated for 
longer life, lower actuator power, and larger gimbal angles. 

The Redstone thrust chamber was cooled through the double-shelled construction of '/s- and 1 74 - 
inch plates and contained several expansion joints. The shell plates were replaced by very long, thin 
tubes that significantly reduced the engine weight, eliminated thermal buckling problems, and allowed 
high-rate gimbaling at reduced actuator loads and power. Alcohol and hydrogen peroxide fuel systems 
gave way to a common kerosene lox propellant system for propulsion and pump turbine power. 

It should be remembered that, initially, the Redstone was to be essentially a German V-2 built to 
American standards by the Army with the Germans brought to this country after World War II. The 
engine started out as an Air Force development program with a three-phase initiative: to understand 
liquid propulsion, derive the physics formulation in all associated disciplines, and apply the derived 
physics of a V-2 type engine using American standards and advanced physics. The final results were 50- 
percent less weight and 50-percent more thrust. This work was transferred to the Army team, which 
developed the Redstone. In the end, due to the innovations applied, it evolved to a true defense missile 
with a large warhead. 

3. Problem Examples . 

a. Redstone Potentiometer Feedback . The first dynamic problem experienced occurred early 
in the Redstone rocket program. A Redstone vehicle was in checkout and verification in a horizontal 
position in its transportation cradle. These early vehicles were manufactured at the Redstone Arsenal, 
checked out, then transported to Florida for launch. In this case, the control system was activated for 
checkout. The control sensors had a potentiometer pickup; due to some light shock, the wiper arm was 
moved from one wire to another, which resulted in a control signal. As a result, the jet vanes moved, 
exciting a structural mode. The structural mode in turn caused the wiper arm to move back, creating a 
new signal. The result was a closed-loop limit cycle instability between the sensor (pickup) jet vane 
(inertia), and structural mode, ringing out at the first mode frequency. The noise of this closed-loop 
resonance was very loud, vividly demonstrating closed-loop instabilities. The fix was simple in that a 
filter was incorporated in the loop that filtered out the frequencies associated with the modes and sensor 
pickup, breaking the loop and stabilizing the system. A later design also changed the pickup to a con- 
tinuous magnetic type, adding margin to the problem solution. 
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b. Jimspheres (Atmosphere Sounding Balloons Erratic Response) . Atmosphere environments 
are key to predicting space vehicle response during the ascent phase. Atmospheric winds are the key 
parameter to loads, flight mechanics, and control prediction. As a means of developing a statistical 
quantification of these winds, a balloon radar tracking system was developed by MSFC’s atmospheric 
group under the leadership of Dr. William Vaughan. The goal was to not only measure large-scale or 
mean environments, but to get an accurate quantification of the wind gust down to 25-m wavelengths. 
The attempt to measure these small gust effects met with frustration. The smooth skin balloons were 
unstable (type of flutter or vortex shedding). In a controlled, no disturbance environment, a rising sphere 
would oscillate (fig. 14). A classical problem most would say. Dr. Jim Scoggins found the solution by 
observing the golf ball, then instead of small dimples, he added many conical spikes to the sphere’s skin. 
The problem was solved. The sphere was stable (fig. 15). The resulting data base used throughout 
NASA is evidence. As a result, this modified sphere was named Jimsphere (after Jim Scoggin) as well 
as the data base (fig. 16). Many people have a small tie clasp with a miniature Jimsphere as a reminder 
of the agony one sometimes must go through to achieve the innovation required for solution to 
unexpected problems. 




Time lapse trace of Jimsphere ballon released 
at 11:54 p.m., August 2, 1963 during stable 
atmospheric conditions and light winds. 

Figure 14. Unstable Jimsphere time history. 


Time lapse trace of rose ballon release at 
11:25 p.m., August 2, 1963, during stable 
atmospheric conditions and light winds. 

Figure 15. Stable Jimsphere time history. 
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Figure 16. The Jimsphere balloon wind sensor. 


c. Jupiter Sloshing Instabilities . A closed-loop control instability occurred on the early Jupiter 
firings. The Jupiter was a liquid propelled military vehicle. Sloshing propellant coupled through the 
control system and became unstable. This instability saturated the control system, and the vehicle went 
out of control during the maximum dynamic pressure regime of launch and broke up. The results were 
dynamic, with beautiful fireworks high in the sky, but very costly to the program. The instability was 
aggravated by the trajectory tilt program. The tilt program was a series of discrete steps instead of a 
continuous functional change that started the oscillation and reinforced the amplitudes of the wave 
through a forced oscillation. At this early phase in the rockets and space age, models did not exist for 
analyzing problems of this type. As a result, several .things happened. Propellant sloshing data had to be 
obtained quickly. No analytical solutions were readily available. A test program was started that 
included both scale-model and full-scale testing. A slosh suppresser had to be found before the next 
launch. In order to meet this goal, a full-size propellant tank filled with water was placed on a railroad 
car. The railroad car was bumped against the track end stop as an excitation source. The first test was 
without suppression devices. Water was used to simulate propellant to establish frequencies, etc. Vari- 
ous devices were tried next as suppressers. The one chosen was called beer cans, which consisted of 
long perforated cylinders with flotation spheres at the top. The entire surface of the propellant was 
covered with these devices (fig. 17). The test showed more than adequate suppression was achieved, and 
the next launch was slosh free. In the meantime, other solutions were pursued, including development of 
analytical characterization of the sloshing propellant. This resulted in the development of slosh baffles 
(rings inside the tank that became part of the structural stiffness (fig. 18)), as the most effective 
analytical means of suppressing slosh, and parametric test data were acquired for oscillating propellants 
in both zero- and high-gravity (g) fields. Today, all space vehicles are analyzed and designed with this 
phenomenon in focus as a potential problem. The lack of analytical and experimental data prior to 
launching, as well as lack of experience in these type problems, led to the failure of the Jupiter missile 
due to propellant sloshing control system coupling. The fix was fairly easy and did not impact flight 
schedules drastically. This is not always the case, and repeats of this type instability should be avoided if 
possible. The innovative way special tests were conceived and conducted to meet launch schedules 
should be a lesson in this age of precise testing. 
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Figure 17. Beer cans, Jupiter anti-slosh devices. 



Saturn V SW-IC Fuel Tank Assembly 

Figure 18. Slosh baffles, Jupiter missile. 



B. Saturn/Saturn ApoIIo/Sfcy/aZ> Launch Vehicles 


The Saturn family was a unique experience in the evolution of space technology. 23 Being a 
family, it provided a building-block approach that led to the successful Moon landing and the Skylab 
space station program. It was all built on the foundation of the successful Redstone and Jupiter vehicles. 
The Skylab space program had two distinct parts: (1) the launch systems used to launch both the station 
the manned visits used modified Saturn V and Saturn IB vehicles, and (2) the operations of the Skylab 
space station and Apollo telescope mount (ATM). The Skylab launch vehicle is put in this section 
because of the commonalty of the launch systems. The Saturn family is shown in figure 19a. 

1. Characteristics . The Saturn I was envisioned as both a test-bed and a launch vehicle built 
using available technology and manufacturing tooling. The first stage was derived using a cluster of 
eight Redstone size and one center tank of Jupiter size propellant tanks and a cluster of eight of the 
Jupiter engine system. Figure 19b gives its characteristics. The lower ends of the tanks were attached 
rigidly to a large thrust frame. The engines were attached to the other side of this frame. The upper ends 
of the tanks were attached using a spider beam that also attached the second stage SIV. The tanks 
containing the cryo propellants had to have longitudinal slippage to account for thermal contraction, thus 
the load paths from the first stage engines were through the center tank and the four fixed fuel tanks. The 
sliding joint on the lox tanks were at the upper end as a connection to the spider allowed for the thermal 
expansion. 

The second stage, SIV, was a liquid hydrogen/lox stage powered by a cluster of RL-10 engines. 
A very interesting story occurred relative to the first launch of the Saturn I vehicle. The SI was 
dynamically tested full scale to validate its complex dynamic characteristics. In order to simulate the 
flight conditions of free-free, the vehicle was suspended on bungy cords (elastic supports) where the 
vehicle suspended frequency was well separated from its first free-free frequency. In attempting to 
remove any residual effects of this suspension system on the free-free modes, an analytical technique 
(filtering of data) was attempted. Due to round-off errors in the data, instead of removing any unwanted 
effects, the process introduced three false modes in addition to the actual modes. Incorporating these 
modes into the control stability analysis indicated an unstable vehicle. The initial launch was held up for 
2 weeks to sort out the problem. This problem got played in a Fortune magazine feature article. During 
the 2 weeks, it was possible to show that the modes were indeed false. In a big meeting with Von Braun, 
the decision was made to launch. The launch was totally successful. Testing approaches and data 
evaluation are a key element to the success of any program, as was so strongly illustrated here. 

The Saturn IB was a derivative of the Saturn I with improvements to the structural and 
propulsion systems, including performance upgrade (fig. 20). The second stage SIVB had a new single 
liquid hydrogen/lox engine replacing the cluster of RL-lO’s in order to get more performance and higher 
reliability. The Saturn IB was used as the technology and operations demonstrator for the Saturn V 
Apollo. In fact, they both used the same SIVB stage and essentially the same guidance and control 
system. The Saturn IB became the launch vehicle for the manned launches to the Skylab space station. 

There were two versions of the Saturn V: (1) the vehicle that launched all Apollo Moon missions 
and (2) the version that launched the Skylab space station. Saturn V Apollo was a three-stage propulsion 
vehicle plus the manned command and service module and the lunar excursion module (LEM). On 
later flights, it also contained the lunar rover stowed in the LEM. Figure 21 shows the overall 
configuration and its characteristics, while figures 22 through 24 are the configuration and 
characteristics of the three propulsion stages. In the case of the Saturn V Skylab, the SIVB stages were 
replaced with Skylab space station with only the first two stages being propulsive. This changed the 
external geometric configuration and thus its ascent loads. Figure 25 shows this configuration and its 
characteristics. The Skylab itself contained the living features with life support for the crew, a docking 
module, the ATM, and solar arrays on both the ATM and the workshop for power to operate all 
the systems. Skylab was a very successful program. After the four science missions were over, it 
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Figure 19a. Saturn family. 
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Figure 19b. Saturn I configuration. 
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Figure 21. Saturn V configuration 
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Figure 25. Skylab Saturn V configuration comparison. 


stayed in orbit for several years. If the shuttle had made its original operations goal (launch), Skylab 
would have been reboosted and used as a forerunner to the planned larger space station. However, this 
did not happen and Skylab reentered the atmosphere, landing in Australia. 

2. Evolution/Creativitv/Innovation . During early development, many trades were done as the 
approach to use for going to the Moon, i.e., trans-lunar versus Earth-orbit rendezvous and docking. As 
history bears out, this heated debate ended with general acceptance of the trans-lunar injection. During 
this time, requirements indicated that four F-l ’s on the S-1C stage and four J-2’s on the SII stage would 
meet performance requirements. However, it was decided to equip the S-1C with five F-l ’s and the SII 
with five J-2’s. This was a very good stroke in that it compensated for weight growth, addition of mar- 
gins, and the added missions using the Lunar Rover and the Skylab mission. 

The Saturn and Saturn Apollo programs saw the maturing and harvesting of many technologies. 
This was due, in part, to the focus of landing a man on the Moon within the decade of the 1960’s, the 
evolving of faster large computers with more mature codes, and the increasing education of engineers. 

The control community developed and implemented the load relief technology using acceler- 
ometers instead of external flow-mounted angle-of-attack meters. Elastic body (modal) response and 
stability was a major issue and required the development of approaches to integrate structural dynamics 
and control. A natural extension was the development of modal suppression (in the aeronautics side, this 
was called ride control) techniques that, in conjunction with rigid-body load relief, not only reduced the 
basic aerodynamically induced loads, but also reduced the response due to elastic-body dynamics and 
wind gust and turbulence excitation. Years later, this technology evolved into active flutter suppression 
and aeroelastic tailoring. 

The long, slender configurations raised many questions in terms of this control, structural, aero- 
dynamic systems due to potentially strong couplings (aeroelasticity). Technology evolved based on air- 
craft experience to deal with static aeroelastic effects, gust penetration, and the hammerhead effects. The 
technology involved not only analysis, but also scale-model wind tunnel testing. 

While on the launch pad, vortex shedding was a real problem. This was solved through the use of 
a dynamic damper between the vehicle and the launch pad service tower, which had a disconnect for 
launch. This led to a wind constraint for launch in order to not have vortex shedding during the short 
time the damper was disconnected. One very innovative technique used to understand the vehicle struc- 
tural dynamics characteristics while on the mobile launch platform (MLP) was the so-called tennis shoe 
test. The full-scale assembly of the mated test vehicle was assembled on the MLP in the vertical assem- 
bly building. Engineers wearing tennis shoes went to the platform near the Apollo capsule and excited 
the first bending mode by pushing with their tennis-shoe-clad feet. Modes were obtained with and with- 
out the modal suppression damper. This verification was accomplished with very little paper documen- 
tation and cost. 

Wind biasing technology matured and became a viable operational tool for adding flexibility and 
increasing margins. All these technologies required developing and maturing technologies in several 
additional areas. 

1 . Measuring and quantifying the atmospheric characteristics in terms of wind speed, shears, 
gust, and turbulence 

2. Statistical data evaluation techniques, tools, and models 

3. Structural dynamic characterization of complex systems. 

In the atmospheric characterization arena, the Jimsphere balloon and better radar tracking tech- 
nology developed, allowing the description of the winds down to gust in the 25-m range. During this 
time, the synthetic wind profile matured to incorporate not only wind speed, but also shear and gust. 


34 



Three approaches were developed to handle the gust: (1) a 9-meter square wave that was tuned to match 
the vehicle lower mode frequencies, (2) tuned sine wave gust where amplitude varied with frequency, 
and (3) power spectral density formulation of turbulence. 

A month-by-month statistically significant sample of what were called real wind profiles were 
developed through a comprehensive wind sounding program. These wind profiles were used to run 
Monte Carlo elastic vehicle control response analysis using a high-speed repetitive analog computer. 
This was a new analog computer that was developed for this analysis by a group of MIT professors. This 
system not only allowed a statistical characterization of the vehicle wind response; but also produced 
valid quantification of the synthetic profile approach for vehicle wind simulation. Additionally, it pro- 
vided a technique to determine a probabilistic statement of the wind-induced vehicle loads. This prob- 
abilistic statement was key to the Saturn V Skylab launch statement. 

One aside in terms of the synthetic wind profile development was the question of how to prop- 
erly combine the wind speed, shear, and gust and how to do a conditional probability assessment. 
Putting together three-sigma (3 a) values of each was obviously too severe. Helmut Horn came up with 
the idea of conditionally dealing with a 3 a wind speed root-sum-squaring (RSS’ing) the 3 a shear and 
gust. William Vaughn was fundamental in this also, as well as in developing the wind sounding technol- 
ogy. Because the atmospheric (winds) had preferred monthly directional and speed characteristics, the 
technology evolved for biasing the launch trajectory to the monthly mean wind, reducing wind induced 
structural loads and increasing the launch probability/flexibility. Some performance loss occurred due to 
the path errors introduced in order to reduce angle of attack. 

The synthetic wind profile approach did present one problem in that the vehicle response to 
winds had to consider variation of other vehicle parameters (control, aerodynamics, propulsion, struc- 
tures) in addition to winds, and also the stress analysts and designers needed time-consistent data in 
order to perform adequate analysis. Judson Lovingood developed the A-factor approach, which took the 
RSS’ed responses from sensitivity analysis to produce scalings of the parameter variations that, when 
applied, produced a time response analysis with the same peak as the RSS’ed sensitivity analysis. 

The development of structural dynamic characterization tools, their accuracy and validation, was 
fundamental to many of the design analyses and solution of problems discussed previously, as well as 
others such as pogo. Finite element structural analysis computational tools were developed late in the 
Saturn programs. SPAR was started, which was more of a process or procedure, as was NASTRAN, 
which started and matured during this time. Computer speed and capability precluded extensive use, 
thus the Saturn I (clustered tanks) was analyzed using 20 equations that were coupled through energy 
(generalized coordinates, Lagrangian approach) to get the overall system modes. This was a form of 
what is now called modal coupling. Full-scale dynamic, as well as scale-model dynamic test technology 
was initiated, and these analytical system modes were verified or correlated. 

Suspension approaches/sy stems were key to dynamic testing of full-scale vehicles in the simu- 
lated free-free conditions. Criteria for these systems evolved along with configurations. Hydraulic or oil 
support bearings at the base of the total vehicle replaced bungy cords. Air bags were used on some con- 
figurations to isolate the suspension cables. Other innovative tests occurred such as the tennis shoe test 
discussed earlier was an example. Another was the use of 2-by-4’s for damping the suspension system 
during dynamic test of the SI and SI-B by tying the suspension lines to the test stand with the timbers. It 
worked very effectively by changing the dynamic lateral mode of the line. It was demonstrated during 
this time that scale models had to have the manufacturing tolerances reduced by the scale factor or 
exaggerated deadband play would change the dynamic characteristics. Computer technology for both 
modal data acquisition, evaluation, and the excitation systems greatly simplified and started the process 
of automation. This computer technology used on Saturn model testing was a first. The hardest problem 
to model was the nonlinear fluid analysis of the J-2 which was needed for the SII and SIVB pogo 
analysis and their solutions. The data were finally obtained from flight results and some hot-fire ground 
tests. 
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It was learned and demonstrated during this time that in scale-model testing not only the materi- 
als had to be scaled, but also the manufacturing tolerances or else the nonlinearities of the gaps biased 
the dynamics. Modeling for pogo (S V) was even more complex due to the hydroelastic coupling. Tank 
bulkheads had to be modeled in detail. Propellant ducts had to have both their structures and acoustics 
determined as did the cavitation compliances of turbopumps. Verification required testing for many 
modes and instrumenting both the fluid and the structure. Single-point random structural dynamic test- 
ing technology was developed and applied to the lox tank/bulkhead hydroelastic testing. Defining and 
ensuring correct and known test boundary conditions were also major issues. 

Technology in dynamic analysis evolved very fast during Saturn/ Apollo development and 
required nonlinear simulations in order to characterize the cavitation effects, etc., associated with prob- 
lems such as pogo that occurred on Satum V. Analog and hybrid computers were the main tools used 
because it was easy to represent the nonlinearities if they were understood. Great physical understanding 
was required in order to implement the system on these computers as well as deciding what nonlineari- 
ties were essential. Capacity limited what could be described. This meant most of the describing equa- 
tions could be linear and implemented on the digital portion of the hybrid. The nonlinear elements were 
implemented on the analog side. 

Multidisciplinary analysis was becoming a major technological development, as the above dis- 
cussions imply. The coupling between the propellant utilization system (optimizing propellant usage and 
lower residuals) and the guidance system of the SIVB stage was a major step in simulation. It was more 
than just propulsion and guidance. We called it (Harold Scofield’s quote) “the world’s longest closed- 
loop system: slosh/propulsion utilization/engine/ guidance/control.” These various problems were the 
beginning of the major multidisciplinary technology development that would continue to develop 
throughout aerospace history. 

The development, qualification, and certification of the various components were major tech- 
nological developments. Analytical techniques were not too adaptable to developing the vibration cri- 
teria arising from mechanical and acoustical sources. This led to the development of data banks from 
both the environment and response side based on component masses and mounting configurations. 
Scaling technology was developed for taking new environments and new components and scaling new 
responses from this in order to develop the vibration criteria. The testing side developed force and con- 
trol technologies and hardware for qualification of these components to these vibration criteria on shake 
tables. 


The Satum V vehicle was the first launch vehicle that took the developing linear elastic fracture 
mechanics technology into the initial design phase. The phenomenon of structural failure by catastrophic 
crack propagation below yield stresses had been known for many years. The Satum V propulsive system 
tanks were the first space structure where critical flaw lengths were calculated and a proof test pressure 
was implemented on all production tanks to ensure that any undetected cracks or crack-like defects 
would not cause failure during the cycle life of the mission. 

The author was not involved personally in other technological developments; however, many 
were just as innovative as these discussed. The development of the right materials, particularly the 
welding technology for the large propellant tanks that not only contained the liquid but also were the 
load carrying structure for thrust loads, is a good example. 


C. HEAO 

1. Characteristics . The sophistication of the tools of high energy astronomy has increased 
dramatically over the past 2 decades, culminating in the HEAO program, which put three satellites into 
orbit, each carrying over 3,000 lb of experiments. This program has transformed high energy astronomy 
from an interesting tributary or side branch to one of the main channels of astronomical research. The 
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HEAO experiments have made it abundantly clear that if we want to understand an astronomical object, 
we must look at its radiation at all energies, not just in the narrow optical band. 24 

HEAO was actually three different satellites designed to explore far space from orbiting systems 
using x-ray telescopes. The three different missions carried different instruments and program objec- 
tives. The first was a scanning mission to survey and map x-ray sources throughout the celestial sphere 
over a wide range of x-ray energies. The other two missions had more specific objectives. HEAO A was 
launched August 12, 1977, and ceased operations January 9, 1979. HEAO B was launched November 
13, 1978, and ceased operations April 26, 1981. HEAO C was launched September 20, 1979, and ceased 
operations May 30, 1981. 


The launch vehicle was the Atlas-Centaur rocket built by General Dynamics Convair Aerospace 
Division, with the engines provided by Rocketdyne and Pratt & Whitney. The total height of the HEAO 
Atlas-Centaur vehicle ready for launch was 39.9 m (131 ft), with a total launch weight of 165 tons, of 
which of the spacecraft plus experiments first of three and half tons, including one and a half tons for the 
experiments (fig. 26). 
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Figure 26. HEAO Atlas-Centaur. 

The spacecraft that carried the HEAO experiments was built by TRW Systems. Their role was to 
design and develop the HEAO spacecraft, to integrate the mission, to support launch operations and to 
perform flight operations of the in-orbit observations. The basic HEAO A is sketched on figure 27. A 
sketch of HEAO B is shown on figure 28, while HEAO C is shown in figure 29. The program was very 
successful, adding greatly to science and our understanding of the universe. 

2. Evolution/Innovations/Creativitv . There were many innovations in the HEAO program; 
however, most were in the instruments and science, which the author was not involved in at the time. 
Reference 24 covers these extremely well, as it also does for the evolution the program through its ups 
and downs, including one program cancellation that forced a total reassessment and redesign of the pro- 
gram from four large spacecrafts to the three smaller ones actually flown. This is a story within itself 
and deserves contemplation before embarking on new programs of this scope. 

3. Problems . One problem associated with HEAO will be discussed briefly, the launch vehicle 
had a pogo problem. Pogo occurred to some degree on each Atlas flight near the end of the main stage 
burn. It was never viewed as a problem for most launches since the payloads could easily handle the 
loads. The concern for HEAO occurred because on the last two or three launches the amplitude 
increased. The concern was that this increase signaled a potential blossoming of pogo to the extent that it 
would be damaging to HEAO spacecraft. Much analysis of flight data and pogo studies were made in 
order to understand this potential problem. It was finally decided that it was an acceptable risk to launch 
HEAO without any pogo fixes. This was done with no problem occurrences and without further pogo 
amplitude increases. 
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HEAO Mission A Eperiments Configuration 
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Figure 27. HEAO-A configuration. 
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Figure 28. HEAO-B configuration. Figure 29. HE AO-C configuration. 


D. IUS/PAM-S/TOS 


1 . Characteristics . The IUS was an upper stage vehicle under Air Force management that NASA 
bought for several of its missions, including the launching of the tracking data relay satellites (TDRS). It 
consisted of a solid propulsion stage and an inertial unit for guidance and control. For planetary 
missions, it was modified by adding an additional stage named payload assist module (PAM-S), built by 
McDonnell Douglas. The IUS was designed and built by Boeing. Figure 30 shows the basic IUS 
configuration as used by NASA for its different missions. It weighed 32,000 lb and was designed to fit 
into the shuttle cargo bay with the payload attached to the IUS nose. The configuration with the PAM-S 
attached with its payload is shown on figure 31. One additional part of the design had to do with the 
support cradle that had to raise the IUS perpendicular to the shuttle payload bay, then eject out of the 
bay. The first stage was not ignited until the orbiter had moved a safe distance from the IUS system. 
This cradle, with the IUS attached in the orbiter bay, had to have a special design to move the resulting 
scissors mode away from the shuttle lift-off dynamic modes, or pay a huge weight penalty. For safety 
reasons the expulsion system was energized by springs instead of pyros. Figure 32 shows the cradle 
design. 


2. Creativitv/Innovations . Several innovative design features were incorporated in the IUS 
design (fig. 33). It used an extruding nozzle extension in order to conserve space in the transportation 
mode. Pyro initiated time instead of electronics was used for timing of separation, etc., as was also done 
on the PAM. The design of the cradle and separation system was unique and of a safe weight, and it was 
safe for manned flight. The simplicity made for a robust system. 

3. Problems . The main problem that occurred with IUS was early in the program when it was 
being launched from Air Force missiles for their payloads. The extruding nozzle extension failed, 
causing a loss of mission. Teams of Air Force, NASA, and industry were formed to evaluate the 
problem and come up with a fix. This was accomplished and no further problems have occurred other 
than the normal changing out of parts as they aged on the shelf between uses. 


• Length: 17 ft 

• Weight: 32,500 lb 

• 3-Axis Stabilized 



Figure 30. Basic IUS configuration. 
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ULS/PAM-S/1US Configuration 
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Figure 31. IUS PAM-S configuration and IUS-PAM-S Ulysses configuration. 
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Figure 32. IUS PAM/Ulysses sequence of events. 


41 





IUS-17/PAM-S ASE-2 Configuration 
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Figure 33. ASE configuration. 


E. Skylab, America’s First Space Station 

1. Characteristics . “The vast accomplishment of Skylab — in solar and stellar astronomy, in 
detailed study of our planet from the incomparable vantage of orbit, in using the exciting new laboratory 
tool of weightlessness, and in proving man can work productively in space for extended periods — are 
almost too profound to grasp. The legacy of Skylab to be passed on to planners and operators of future 
manned space programs is best stated in two words: can do!” according to Rocco A. Petrone. 25 

The Skylab space station evolved into a configuration composed of (a) docking adapter; (b) solar 
observatory; (c) airlock module; (d) workshop solar wings (solar energy for electric power) (was 
launched with two solar wings, but operated with one since the other was lost during launch); and (e) 
workshop and living quarters (fig. 34). Cutaways of the living and working quarters are shown on figure 
35 and include all the life support system shown on figure 36. Table 1 lists the basic subsystems, the 
manufacturers, module name, function, length, diameter, and habitable working volume. The heart of 
the science mission was the solar observatory (fig. 37), which had its own fine pointing control system 
with ATM instruments, solar power system (four solar arrays), and EVA access. A typical mission 
profile is shown on figure 37. 
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Figure 36. Skylab life support system. 


sequence ot parasol deployment, (a) Parasol operation Full extension and partial deployment, (d) Fully deployed 
from interior of airlock, (b) Parasol at partial extension, (c) end retracted for serrice. 


Figure 37. Skylab parasol canopy. 

The space station was launched using the Saturn V first two stages, with the workshop replacing 
the SIV B third stage and the command and service module (CSM). The CSM was launched separately 
using the Saturn I B launch system. Three visits (missions) were carried out with three different crews 
over the span of approximately 6 months, with a total manned orbit days in space of 1,171 days, 
dictating the need to provide the crews with comfortable living quarters and a healthy and safe living 
and working environment. This meant that not only did the system have to depend on the internal active 
thermal control system, but it also had to be shaded from the direct Sun rays. 

A table of the missions of Skylab is shown in table 2, providing duration, EVA’s, observations, 
etc., and showing the outstanding success achieved in the presence of major problems. The ability of the 
human innovation and creativity to solve major problems with work around demonstrated the “can do” 
attitude effects. 

2. Evolution. Innovation. Creativity . It is not possible in a report of this type to even hint at the 
scope of the evolution, innovation, and creativity accomplished in order to ensure the successful 
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Table 1. Skylab configuration. 



A 

B 

C 

D 

E 

Module 

CSM 

Docking adapter 

Solar observatory 

Airlock 

Workshop 

Manufacturer 

Rockwell 

International 

Martin Marietta 

MSFC 

MDAC-Eastern 

MDAC-Westem 

Module name 
(development) 

CSM 

Multiple docking 
adapter 

ATM 

Airlock 
module/fixed 
airlock shroud 

Orbital workshop 

Function 

Crew ascent and 
descent 

Docking interface 

Solar observation 

Power control and 
distribution 

Primary living and 
working area 



Controls and 
displays 

Power source 

Environmental 

control 

Laboratory 



Earth observation 
Stowage 

Attitude control 

Data center 

Extravehicular 
activity hatch 

Power source 
Stowage 





Caution and 
warning 


Length 

10.45 m (34.3 ft) 

5.27 m (17.3 ft) 

4.05 m (13.3 ft) 

5.36 m (17.6 ft) 

14.66 m (48.1 ft) 

Diameter 

3.96 m (13.0 ft) 

3.04 m (10.0 ft) 

3.35 m (11.0 ft) 

3.04/1.67/6.70 m 
(10/5.5/22 ft) 

6.7 m (22.0 ft) 

Habitable working 
volume 

5.95 m3 (210 ft 3) 

32.28 m3 
(1,140 ft3) 


17.66 m3 (624 ft3) 

295.23 m3 
(10,426 ft3) 


Table 2. Skylab missions. 


Manned Periods 

First 

Second 

Third 

Total 

Launch 

5/25/73 9 a.m. EDT 

7/28/73 7: 10 a.m. EDT 

11/16/73 9:01 a.m. EDT 


Splashdown 

6/22/73 9:49 a.m. EDT 

9/25/73 6: 19 p.m. EDT 

2/8/74 11:17 a.m. EDT 


Duration (day:h:min) 

28:0:49 

50:01:9 

84:01:16 

171:13:14 

Revolutions 

404 

858 

1214 

2,476 

Distance (million miles) 

11.5 

24.5 

34.5 

70.5 

SEVA a 

0:37 (5/25/73) 




EVA l b duration (h, min) 

3:30 (6/7/73) 

6:29 (8/6/73) 

6:33 (11/22/73) 


EVA 2 duration (h, min) 

1:44 (6/19/73) 

4:30 (8/24/73) 

7:01 (12/25/73) 


EVA 3 duration (h, min) 


2:45 (9/22/73) 

3:28 (12/29/73) 


EVA 4 duration (h, min) 



5:19(2/3/74) 


Total EVA’s 

5:51 

! 13:44 

22:21 

41:56 

Solar observatory photos 

30,242 


75,000 

182,842 

Earth resources photos • 

8,886 


17,000 

40,286 


a. Standup (in spacecraft hatch) EVA. 

b. EVA (completely outside of spacecraft). 
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missions of Skylab. This is particularly true in light of the major damage done to the station during the 
Saturn V launch, which led to major on-orbit repairs, etc. Skylab was an observatory, a zero-g 
laboratory, and living quarters for three men, with all that implies in terms of power, life support, 
science, observation requirements, etc. If one has an interest in the Skylab space station, First read NASA 
SP-4000 edited, by Leland Belew. Other information is also present in references 26, 27, and 28, and 
other NASA historical publications. 

Skylab started out as a “wet workshop,” which was an active SVB stage outfitted on the ground 
with laboratories, etc. After the SIV B bum, the stage would be purged and made ready as a workshop. 
The observatory, ATM, was launched separately and was first to be a free flyer or docked with the spent 
SIV B stage, the workshop. As the program evolved, these concepts were dropped, with the basic SIV B 
stage being remanufactured to being a dry workshop. In other words, it was built and launched as a 
combined ATM and workshop with the docking adapter. The first two stages of the Saturn V could 
effectively launch this combined system into orbit by replacing the CSM with a protective aerodynamic 
shroud that shielded the ATM and docking module during ascent and was then ejected in orbit, exposing 
the ATM and MDA. For this approach to be effective, the ATM and its solar arrays and the workshop 
solar wings had to be stowed during launch and then deployed on orbit. This allowed efficient use of 
launch vehicle space and maintained essentially the same aerodynamic configuration for the Saturn V 
launch vehicle. Using the dry workshop concept allowed the development of adequate living quarters, 
laboratories, supplies, etc., to be stowed and launched together, saving much on-orbit assembly. 

Innovations and creativity were clearly evident in all aspects of the design. The meteoroid shield 
was also a thermal shield. Mixtures of gold and white paint further enhanced the ability to receive heat 
(gold) or reject heat (white). Combined with this system were refrigerator cold plates, radiant heaters, 
radiators, etc., which got rid of heat generated by heat-producing equipment as well as the Sun’s rays 
and, thus, maintained a balanced temperature. Exercise equipment for the crew was provided, as was 
carbon dioxide removal, waste management, etc. 

In order to stay on orbit for 9 months, power had to be generated using the Sun’s energy. The 
station had to be controlled as to its position in space, as well as maneuvered, and the ATM had to point 
accurately at the solar system. Control moment gyros were used for pointing and stability, while the 
reaction jet control system maneuvered and maintained basic position. The ATM had a fine pointing 
vernier system relative to the basic Skylab orientation. As stated above, read NASA SP-4000 to get a full 
impact of this expression of creativity. 

Probably the greatest innovation and creativity occurred due to the problems created during the 
Skylab launch on the Saturn V. The next section on problems will also discuss these great recovery 
efforts. 


3. Problems 

a. Meteoroid Debris/Solar Wing Failure . During the launch phase at around 60-s flight time, it 
was observed that problems had occurred with the micrometeoroid shield as evidenced by the rising 
temperature; however, the launch continued flawlessly and the Skylab was injected into orbit. In orbit, 
when the workshop solar wings were being deployed, it was clear that a mooring problem had occurred. 
Data indicated that one wing was gone and the other only partially deployed. Also, the temperature of 
the workshop was rising to dangerous levels, threatening medical supplies, etc. The workshop 
equipment was not designed for these high temperatures. The crew flight scheduled for the next day was 
delayed 10 days in order to understand the problem and design fixes. There was also a concern that the 
high temperature would cause the internal insulation to give off life-threatening gases. With much 
ingenuity, ground control was able to orient the workshop to balance the temperature around 1 30 °F. 
Since the workshop had very little solar power, most of the power to maintain the station was obtained 
from the ATM’s four healthy solar arrays. The system was designed to pass power from one system to 
the other. The cause of the failure of the meteoroid debris shield and the solar wing was an improper 
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venting design of the box that contained the wing, which caused it to trap the 14.7 lb/in 2 ground 
atmospheric pressure that in near vacuum ripped the wing loose and destroyed the debris shield, 
exposing the gold covering of the workshop. 

NASA Centers worked around the clock to understand the problem and to design fixes. The 
missing solar thermal/debris shield had to be replaced. Many options were looked at, with two being 
designed, built, and verified. Their installation was practiced extensively in Marshall’s Neutral 
Buoyancy Simulator tank, designed to simulate zero gravity working conditions for astronauts. One 
lesson is clear: “one must have in place the technologies needed when problems occur.” The two solar 
thermal systems were: (1) a fold-up parasol type shield that could be deployed off the workshop airlock 
viewing port by the crew (this was accomplished on the first mission and went a long way in stabilizing 
the temperatures, which dropped to 90° (fig. 38)), and (2) a twin-pole sail, which was deployed by the 
second crew using EVA by the astronauts (fig. 39). The second shield was more effective and lasted the 
life of the station. 



Figure 38. Skylab twin-pole Sun shade. 
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Figure 39. Skylab typical mission profile. 


The second critical problem was to try to deploy the remaining solar wing in order to get enough 
power to run the workshop and free the ATM power system for solar observation. It was envisioned that 
some strap or debris from the failed debris shield was holding the wing. Various types of extendable 
tools, like those used by ground electrical crews, were designed and tested in MSFC’s Neutral Buoyancy 
Simulator facility, as well as the crew was trained in the tank on how to use them. The simulator proved 
an extremely valuable means of approximating zero gravity, allowing training and understanding the 
system. 


The crew, when on orbit, flew the command module around the workshop and observed the 
hung-up wing. They first flew the spacecraft in close and, using a pole out the window, tried to pry the 
wing loose with no success. They then tried to dock with the workshop but were unsuccessful. The next 
day they put on space suits and depressurized the spacecraft, then they disassembled and reassembled 
the docking adapter, after which they successfully docked. 

The next day they entered the workshop and worked the damage, then deployed the parasol Sun 
shade as stated above. The ground personnel at Johnson Space Center (JSC) and MSFC continued to 
work out ways of releasing the solar wing. Fellow astronauts worked with the tools they had carried to 
orbit with the simulated problem in the Neutral Buoyancy tank. 
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On June 2, Conrad and Kerwin opened the hatch on the air lock module and moved out on the 
airlock shroud to assemble their tools and equipment. They tried without success to cut the strap loose 
that was holding the solar wing. Then Conrad made his way out to the strap hung wing with the cutter 
jaws. As he reached the scissors-type mechanism, the cutter severed the strap, moving suddenly, and 
throwing him away only to be saved by his tether. They next had to move the beam out a full 90°. This 
they did with a tether that Kerwin pulled and Conrad lifted in the middle (mechanical advantage), thus 
moving the beam out to the deployed position. The jolt knocked both of them away, but the tether 
contained them and they reentered the workshop. Once inside the workshop, it was possible to warm up 
the actuators and fully deploy and lock in the solar wing. The system could now be balanced and the 
solar observation and laboratory work begun. 

At the start of the second mission, the second Sun shade was deployed during astronaut extra- 
vehicular activity (EVA). They attached the poles, then unrolled the shade, attaching it to the poles. 
Several concerns associated with this Sun shade were worked, and included dynamic excitation from the 
reaction jet control system firings, which potentially could cause large Sun shade deflections. All these 
problems were worked and put to bed. The new Sun shade worked in an excellent manner. 

With these initial problems solved, the Skylab missions continued providing much science as 
well as information of long-duration space work by humans. Skylab set the foundation for the upcoming 
space station. 

b. ATM Dynamic Response . A very interesting problem occurred due to the angles of orienta- 
tion of the ATM during pointing relative to the MDA/workshop. The various observation angles 
changed the dynamic modes in a nonlinear manner, creating unusual demands on the control system 
logic. In order to work this logic problem, dynamic modal analysis was made for each generic telescope 
orientation. These mode shapes and frequencies were used by control analysts to change the control 
logic and verify it, allowing ATM pointing without bending mode instability. The result of this effort 
was a control system that operated for the three Skylab missions flawlessly as evidenced by the teleme- 
tered data, science gathered, etc. 


F. Space Shuttle 

The space shuttle, NASA’s reusable launch vehicle/space platform, is one of the greatest design 
and operational achievements. Being both a manned spacecraft and a launch vehicle, with all but the 
external propulsion tanks being reusable, introduced many conflicting requirements and thus design 
trades. The problems that resulted and their solutions are the subject of this section. They will be dis- 
cussed under the headings: (1) Space Shuttle Systems, (2) Space Shuttle Main Engines, (3) Solid Rocket 
Boosters and Motors, (4) Orbiter, and (5) Spacelab/Spacehab System. 

1. Space Shuttle System 

a. Characteristics . The space shuttle vehicle is composed of an expendable external propulsion 
tank (lox and hydrogen), a reusable orbiter with liquid main propulsion engines (SSME’s), the orbiter 
maneuvering system (OMS), two SRB’s (partially reusable), and the various payloads (fig. 40). The 
payload maximum size is 15 by 60 ft. The maximum weight depends on the desired orbit. The orbiter 
has a stay time on-orbit up to 2 weeks with a crew of up to five. The total weight is approximately 
4.5x106 lb as shown on the schematic in figure 40. The liquid propellant capability is 1,391,144 lb 
19,57 1 ft 3 lox and 233,43 1 lb 52,908 ft 3 hydrogen (fuel). 

Payload usability is enhanced through the development of the Spacelab system, which has both 
habitable modules with experiment racks, thermal conditioning, etc., and platforms in nonhabitable 
regions for mounting experiments (section III-H). The remote manipulator arm allows working on or 
retrieving a satellite. The life support system, although important, is not addressed in detail. Extensive 
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Figure 40. Space shuttle configuration. 

assembly, launch processing, checkout facilities, equipment, processes, tools, and launch facilities exist, 
but are not a major part of this paper. 

Work accomplished during phase B of shuttle demonstrated the strong interdisciplinary coupling 
of the shuttle system. Early trade studies (fig. 41) indicated areas that needed attention, such as trajec- 
tory, thermal, loads, control, performance, and launch operations interaction. Many developmental 
issues and problems surfaced (appendix) that required the use of multidiscipline teams (a pseudo type of 
concurrent engineering team) for resolution. Technology made many advances from the time of phase A 
until the present time. The two major technology drivers were the orbiter reentry thermal protection 
system and the high performance reusable liquid SSME. The evolution of the technology, processes, 
analysis, and tests accomplished on the shuttle are very informative. 

Typical trajectory and mission profiles are shown in figures 42 and 43, which show the basic 
event sequences and the pertinent parameters. 

The shuttle is, and has been, a marvelous machine. It represents the best in a multiple-purpose, 
finely-tuned, complex space system designed to meet very demanding requirements. Although its cost 
per launch did not meet expectations and the operations are more complex than desired, its 60-plus 
manned missions illustrate its capability. A recent one was the capture and repair of the Hubble Space 
Telescope. What a feat that turned out to be! Now the repaired HST meets or exceeds most of its 
original goals. 
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Figure 41. Space shuttle trades/sensitivities. 



Figure 42. Space shuttle typical mission profile. 
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Figure 43. Space shuttle typical ascent and descent trajectory profiles. 

b. Evolution/Creativitv/Innovation . The development of such a complex machine required the 
best in engineering innovation, creativity, and common sense. Management of such a complex 
government-industrial teaming also required the same innovation, etc. At the same time, the shuttle 
marked a degenerative-trend use of suboptional off-the-shelf equipment, rather than special devices 
designed to specification. The Saturn computer was, for example, many times more reliable than the 
collection of processes used to guide and control the shuttle. However, in many ways the shuttle tasks 
were easier than many Saturn tasks. Stabilization and control and structural interaction differences were 
much more mobile for Saturn. 

The two driving technologies required and developed for the space shuttle concept were the 
orbiter reentry heating protection system and the high-impulse reusable liquid engine. Other tech- 
nologies also matured. Dynamic testing technology moved into the multirandom excitation, as well as 
the time domain, as an enhancement to the frequency domain. Scale-model technology was enhanced 
through a 1 /4-scale testing of the total shuttle system. Integrated/multidisciplinary analysis was a key 
technology, i.e., control, performance (flight mechanics), loads, and thermal were highly coupled. Many 
innovations to accomplish this task were developed to support the program. 

Understanding the physical phenomena of ignition overpressure and designing a suppression 
approach was not only a key technology area, but the innovation used in arriving at a fix. Testing of a 
6.4-percent scale-model shuttle propulsion model (fig. 44) and its enhancement allowed both the physi- 
cal understanding and the assessment of the water spray suppression and water troughs. This scale- 
model hot-fire propulsion model was started as a technological development for shuttle during phases A 
and B, and became the tool for fixing the STS-1 overpressure problem. Innovative water curtain testing 
was developed and showed that water blocks overpressure waves, thus the baselining of water troughs as 
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Figure 44. Space shuttle 6.4-percent propulsion model. 

an insurance solution to the water spray injections (fig. 45). The solution of this problem also illustrated 
the complex technical management problem. During the development of the fix, it was thought that in 
the close vicinity of the SRB’s permanent steel plates could be installed to block the overpressure wave. 
After moving along with the design, water spray, troughs in the drift holes, and steel plates around the 
SRB’s, the team leaders kept questioning the feasibility of the steel plates. Eventually during this 
repeated questioning, data were uncovered that showed that the steel plates would reflect the SRM thrust 
and destroy the aft heat shield. Small water troughs replaced the steel plates, averting a loss of the 
vehicle. Innovative leadership/management is a requirement commiserate with the technical. 

The SSME, with its high-performance requirements (454-s specific impulse (Isp)) and a 55- 
mission life coupled with geometric and weight constraints, developed fatigue and fracture issues that 
led to the development or enhancement of several technologies. Dealing with hardware life capability 
issues required a detailed characterization of both structural models and environments, which pushed 
development of computational fluid dynamics technology. This technology started, evolved, and 
matured in 10 years, greatly enhancing the maturity of the SSME. Finite element structural analysis 
matured during this time. Verification of environments required the development of special 
instrumentation for flows, acoustics, and vibration. Internal and external diagnostic instrumentation had 
to be developed. Data diagnostics (particularly dynamic) developed rapidly as well as data basing. 
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Figure 45. Space shuttle water troughs. 

providing the ability to screen hardware and put a quantifiable maintenance and refurbishment program 
in place. This was true for both flow and mechanical vibration. Automation of the vibration data base 
allowed application of the established data base, with its excitation forces to new environments, 
processed components quickly through sealing and similitude laws automatically in the computer code. 
New criteria for shock and vibration testing can be generated in hours, where it used to take weeks. 
Health monitoring systems and engine shutdown systems were also based on these data bases. Cold- 
flow testing for benchmarking the CFD models and verifying environments reached a high level of 
sophistication. These facilities/technologies are both air and water. Normal fracture control technology 
evolved to include high-cycle fracture mechanics and an assessment approach for residual life. 
Combining low- and high-cycle fatigue was a maturing technology. In order to handle the high 
temperatures and pressures, new materials as well as processing techniques evolved. Castings that 
eliminated welds solved many fatigue and fracture problems before they occurred. The problems 
experienced on the engine required indepth understanding of very technically complex problems, which 
required formal approaches for studying the problem. Fault tree analysis complemented with logic 
diagrams and formal action items matured into a very useful tool or process. 

Thermal protection systems in addition to the orbiter were major challenges. Hand-applied glue 
used on parts and the spray-on insulation for the ET were big adventures. The heat shields for the SRB 
and orbiter boat tail had to accommodate gimbaled nozzles and were an extension of Saturn technology. 
Plume heating was still an issue, but was in the realm of predictability using prior data, wind tunnel 
tests, and hot-fire solid and liquid engine ground tests. 

Aerodynamic predictions were a major problem due to the unsymmetrical configuration between 
element-to-element tunnel flow and propulsion system plume interaction. The aerodynamic loads were 
excessive and had to be reduced. This led to elevon load relief and cross-coupled load relief using pitch. 
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yaw, and roll control. The asymmetry of the vehicle also required the development of a vector wind 
synthetic profile to account for both shear and gust and the changing wind direction with altitude. 
Detailed measured monthly wind ensembles were enhanced, as well as the ability to accomplish 
measured wind Monte Carlo vehicle response and loads analysis. 

A big technology that was developed was the day-of-launch I-load update (2 h prior to launch) 
that biased the trajectory to the last measured wind profile to increase launch probability and reduce 
loads. To accomplish this, the wind sounding system developed a new technology called LIDAR to 
achieve the wind data and analysis tools requirements, and to deal with required failure modes (for 
example, engine out) in conjunction with other parameter variations. An innovative technique was 
developed to use 1 a variations of the other parameters with an engine failure occurring 5 s prior to the 
wind gust of the synthetic profile. Therefore, the combined probabilities of the failure and parameter 
variations were near 3cr. For lift-off loads calculations, certain parameter variations changed the time 
sequence of the system, precluding the use of the A-factor approach developed for Saturn. To overcome 
this, all parameters that did not affect timing were RSS’ed in conjunction with a lcr variation worse-on- 
worse of all parameters that affect timing. 

Performance sensitivities of the one-and-a-half-stage concept to parameter variations led to the 
use of the wind data in a mixed fashion. Fifty percent of the wind shears and gusts were treated 
deterministically, while the effects of the other 50 percent were RSS’ed along with the system 
parameters. Because wind direction change was also important to the vehicle response, a vector wind 
synthetic profile was developed. 

The space shuttle was the first vehicle that was coupled in the pitch plane due to center of gravity 
(eg) and thrust offsets, precluding the normal point mass trajectory/performance optimization programs. 
An innovative moment balance (programmed control forces) was developed that allowed a simplified 
approach for trajectory optimization. 

Because the shuttle is a winged vehicle, the high dynamic pressure regime was a major analysis 
problem to adequately predict rigid-body vehicle response to winds and thrust-generated, vehicle- 
induced loads, which included all system parameter variations as well as wind statistics. This was 
accomplished in an efficient manner through the creation of squatcheloids (Tom Modlin’s work) which 
was qa and qp plotted continuously for nominal parameters as the wind direction varied. These 
squatcheloids are generated for each Mach number. A set is also generated for 3cr system parameter 
variations and becomes the basis for the design criteria (figs. 46 and 47). This work has been extended to 
the use of alpha, beta, and “q" combinations instead of the rigid boundary of the squatcheloid, providing 
more freedom in trajectory shaping and the tailoring of the day-of-launch I-loads updates to increase 
launch probability. 

Many other innovations and technologies have evolved such as the use of animation graphics to 
enhance understanding of dynamic response; colored graphics to pictorially show stress, flow, and 
thermal fields; CAD/CAM systems to automate design and manufacturing; information systems/ 
electronic data transfer; and finally, the evolution of probabilistic/risk assessment technologies to the 
point where it is impacting design, verification, and operation space systems. 

The shuttle went beyond proof testing of propellant tanks, etc., to total fracture control. In the 
ET, one-half mile of welds required pre- and post-proof testing inspection. Observed flaws had to be 
dispositioned for flight use by analog testing. The SSME evolved along a different path. High-strength 
material was required to meet the high-performance requirements which were: 

- Two-stage combustion and pump system producing high pressure and temperature 

- High Isp thrust coupled with minimum weight and volume requirements. 
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These resulted in weld problems. To save cost, formal fracture control was initially not a design 
requirement; following the pattern of the Saturn engines, F-l and J-2. The early problems resulted in 
critical components having fracture assessment. Additional problems resulted in more components being 
added, later followed by a weld assessment. This effort has resulted in residual life assessment, 
probabilistic/risk assessment, and the extension of fracture control to include high-cycle fracture in 
addition to low-cycle fracture. Rocketdyne and its fracture control leader have made major technology 
contributions in fracture control state-of-the-art. The first major use of damping seals, invented by 
George Von Pragneau, NASA, had its first use in the turbopumps, which were used to damp whirl 
problems (fig. 48). This seal concept later evolved by Rocketdyne into a hydrodynamic bearing for the 
lox pump and was successfully tested six times. 



Rough Stator Hinders Rotor Whirl 

Figure 48. SSME lox turbopump damping seals. 

Highly redundant TVC systems and APU power systems were developed. As fickle as hydrazine 
systems are, the four that fly on the SRB on every flight have worked perfectly. Parts of these systems 
are quad redundant, while others have only dual parts. It turned out to be an example of good system 
engineering. 

Performance sensitivities led to several weight-saving programs. The ET made a major effort to 
reduce the weight approximately 10,000 lb, producing approximately the same level of payload per- 
formance improvement. 

The innovative design of the total shuttle system used a unique load split or load path where the 
SRB loads were taken out at the forward attach point of the SRB to the ET. This was through all the 
I-beams in the tank inner stage (lox tank forward of load fuel tank to the rear), while the SSME thrust 
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was taken out at the rear of the ET, producing a net load of the difference. The I-beam also tied the two 
SRB’s together. In addition, the hydrogen tank skin thickness was tailored circumferentially and 
longitudinally to the stress field. A portion of the ET that was designed by well-defined loads was based 
on a safety factor of 1.25 instead of the normal 1.4. The cryo shrinkage of the ET when filled created 
two problems. First, the radial shrinkage loaded the SRB (held down firm to the launch pad) against the 
tank (punch load). The SRB-to-ET aft struts were pretensioned to relieve this problem. The longitudinal 
shrinkage also increased loads. Second, if the tanks were perpendicular before filling, they became 7° off 
perpendicular when filled. Therefore, the struts were biased T off perpendicular before tank filling so 
that they were perpendicular during operations. The lox tank was located forward to reduce the c.g. 
tracking excursion by the thrust vector and reduced thrust loss due to the cosine effect of the thrust vec- 
tor angle. 

The innovative use of timing delay of SRB ignition allowed the minimization of the twang 
energy stored in the vehicle due to the SSME’s being at full thrust. Further, the SRB design loads were 
chosen to be worse-on-worse, building robustness and precluding downstream redesigns as loads 
changed. This was a good system choice because the performance loss was only one-twelfth. All other 
elements used time-consistent loads due to the one-to-one performance impact of weight. Also, the SRB 
was not initially designed for water impact. A 5-percent attrition was accepted, thus no large weight 
impacts. 

The programmatic management of the complex technical interaction was an extension of the use 
of working groups and panels started in the Saturn program. The discipline interaction was much more 
pronounced and sensitive than the prior vehicle, creating the need for strong integration of the various 
disciplines, subsystems, and elements. As this need became more and more apparent, various integration 
approaches were tried. The integration working group approach was chosen. In terms of the launch 
vehicle and the propulsion system, this was a group consisting of all the NASA centers’ interacting dis- 
ciplines, leads, elements, chief engineers, and contractor equivalents. The groups working the launch 
vehicle were named the ascent flight system integration group and the propulsion system integration 
group. The key philosophy was that the groups were to be exchange forums and recommending 
groups — not project decision groups. Problems were to flow down to the groups from the projects, up to 
the groups from their members supporting engineers, and from the groups themselves. Although 
structured through co-chair leads and formal action items that could be assigned to any group or 
individual, it was completely open. This created excellent communication and exchange, bringing many 
issues to resolution. This type of working group is obviously not the same as the Product Development 
Teams (PDT) in vogue today, although it carried out many of the concurrent engineering functions and 
also established excellent communications between NASA Centers and their contractors because all 
were a part of the working group and their supporting discipline panels. Whether the use of PDT’s in 
their concurrent engineering focus eliminates the need for this type of working group or its equivalent is 
an open question. For large complex systems, however, some means of integrating and coordinating the 
system focus across the product developments is mandatory. For the shuttle, this approach was very 
effective in resolving the major multidisciplinary system issues inherent in this type vehicle. 

c. Problems . As the space shuttle evolved, reality overcame dreams and visions, thus perform- 
ance problems developed. These were of a wide variety, including payload to orbit capability, cost, 
operational complexity, refurbishment, and maintenance. When a project is faced with a performance 
issue (payload to orbit), there are three options available for dealing with the problem: (1) weight 
reduction (structures, consumables, propellant reserves etc.), (2) performance enhancements (thrust, Isp, 
launch site, bum time, etc.), and (3) operational procedures and constraints (reduced requirements, 
environment reductions, etc.). As has been discussed in this section, the shuttle employed all three 
techniques in order to meet performance requirements. This was accomplished in a very innovative and 
balanced manner from the reduction of safety factors on the ET for well known loads to the high- 
performance motor (HPM) SRM (3,000 performance enhancement, to the 104-percent power level 
SSME. Table 3 is a matrix of the problems that caused performance degradation and the average hit 
followed by a listing of the solutions used to gain performance. 
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Table 3. Shuttle performance degradation/performance enhancements. 

1. Orbiter design against real requirements leads to not meeting weight 

requirements 30,000 lb 

2. Environments (loads) increases due to employing quartering high q winds. 5,000 lb 

Several impacts resulted: 

- Baselining monthly mean wind biasing for design 

- Three-axis and elevon load relief baselined 

- Increased analysis and testing 

- Aerothermal/thermal protection system impacts (SRB and ET) 

- Performance loss from path deviations 

3. SRM fixed nozzle was redesigned to a flex gimbaled nozzle for adequate vehicle 
control. 

4. Lift-off loads increases 

- Staggered SSME start and shutdown 

- Ground winds constraints 

- Weight increases/redesign shuttle elements — » 1,200 # eq payload 

(individual payload impacts not documented) 

- Pre-tensioned SRB/ET struts 

5. Missed aerodynamic predictions/STS- 1 lofting 

- Trajectory constraints q, SRB separation, a trim 

- Performance loss — » 

- TPS impacts ET and SRB 

- Protuberance (ET) redesign/rectification 

- Reduced launch probability winter months — > 

- Orbiter wing mods (leading edge) 

- Day of launch I-load updates 

- Flight- derived dispersions 

6. Isp not meeting design goals 

- SSME — > 2'/2s 

- SRM — » Is 

7. STS-1 SRB ignition overpressure 

- Modified water injection system (into thrust buckets) 

- Water troughs over drift hole 

- Payload loads increases (limited redesign/revivification) 

8. Orbiter tile debond and debris damage 

9. Other 

- Landing gear and brakes 

- Engine upgrades 

- SSME fatigue and fracture 

- ET fracture control 

- Isp loss for plugged lox post 1 s 

- SRB recovers 

• Water impact damage 

• Acoustic (reentry) 

• Thermal (reentry) 


5,000 II 
65 percent 
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Table 3. Shuttle performance degradation/performance enhancements (continued). 


Performance Enhancement 


1. SSME 

- 104-percent thrust nominal 

- 109-percent abort 

- Redesign weight reduction 

3.000 lb 

1.000 lb 

2. ET 

- Safety factor reduction to 1 .25 

- Redesign (super light weight tank) 

10,000 lb 
8,0001b 

3. SRM 

- High-performance motor 

- Bum rate increase 

3,0001b 
1,500 lb 

4. Orbiter 

- Weight reduction design changes 

=10,000 lb 

5. Flight-derived dispersions 


In addition to these performance type issues, several other major problems occurred during 
development not the least of which were the orbiter tile debond, debris damage to the tile, SRM ignition 
overpressure, and aerodynamic deviations. 


d. Future Implications . Any future system will have to deal with realities of performance in the 
same three categories. It is prudent, however, that up front the systems sensitivities be understood and 
robustness designed into the system 19 in order to eliminate, as much as possible, the impacts. 

Although the space shuttle is a marvelous and successful machine, there are some downsides. 
For example, as a result many sensitivities of not only the shuttle system, but also its elements and 
components as well, have led to costly launch delays, maintenance and refurbishment issues, operational 
hands-on labor (touch labor), and cost. A list of the shuttle flight data and an in-flight anomaly list is 
published by JSC in JSC- 194 13 and is revised periodically. A similar report is published at MSFC in 
MSFC-1600 Rev C. They list the mission, Space Transportation System (STS) number, orbiter number, 
event, impact, and remarks. The problem list goes from winds aloft to auxiliary power unit (APU) 
failures to hydrogen leaks. A study was done by Analex Space Systems, Inc., Kennedy Space Center, 
FL, of the “Ability of Space Shuttle to Launch on Time.” This is a comprehensive report, again dealing 
with all the launch delays resulting from weather to sensor failures and everything in between. 

The shuttle as a system is, therefore, very complex, requiring much touch-labor to operate, and is 
limited in performance by its constraints; yet it is indeed a remarkable machine, a marvel, a wonder. 
Future systems, however, need a different approach that is reliable, cost efficient, and, therefore, robust. 
The appendix summarizes the set of problems the author has dealt with in the space shuttle arena. 

The development of space shuttle provided many technologies that have application elsewhere 
and in the future. The following is a partial listing: 

1. Solid rocket motors gimbal nozzle (flex seal) 

2. SRM ablative, refurbishable nozzle 
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3. Lightweight orbiter thermal protection tiles 

4. Acoustics and ignition overpressure suppression techniques 

5. Day-of-launch I-load update procedures 

6. Active multiaxis load relief 

7. Tailored/adaptive SSME throttling 

8. ET spray-on insulation (propellant tanks) (robotics) 

9. Robotic welding 

10. High-strength materials 

1 1 . Hydro-static turbopump bearings 

12. Silicon nitride ball bearings 

13. SRB recovery 

14. High-cycle fracture mechanics techniques (residual life) 

15. High Isp liquid hydrogen engines 

16. Simulated life fracture testing (analog testing) 

17. Digital control 

18. Computer assisted design/manufacturing (CAD/CAM) 

19. CFD 

20. Computational mechanics/rinite element modeling 

2 1 . Microelectronics. 

The next section will deal with the shuttle elements. 

2. Space Shuttle Main Engine . The following section is a collection of materials, data, charts, 
etc., from several sources associated with the SSME. These sources are (1) MSFC and Rocketdyne fail- 
ure investigation reports, (2) Rocketdyne presentations, (3) MSFC/Rocketdyne special problem resolu- 
tion teams, (4) MSFC and Rocketdyne studies and reports, and (5) MSFC and Rocketdyne technical 
society papers and professional journal articles. The engine design work, testing, and operations were 
Rocketdyne’s responsibility. MSFC was the responsible NASA Center. 

a. Characteristics . The SSME is the highest efficient liquid propulsion engine ever built. Its 
complexity and performance are unequaled. It is an example of the degree of craftsmanship possible in 
the design and operation of a high-performance system. As discussed in previous publications, these 
characteristics, in conjunction with the external leveled constraints, produced problems, many of which 
were unexpected because of the high-performance requirements. Bob Biggs, Rocketdyne, wrote an 
excellent paper tracing the evolution of the engine, providing much insight into the engine and the pro- 
gram. Others have dealt with various aspects of its development and problems. 29-34 
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The SSME is a high-performance, throttleable, liquid oxygen/hydrogen space vehicle engine. 
The high Isp and thrust is achieved through a staged combustion power cycle, with high combustion 
chamber pressure using a dual-stage pump and combustion process. The engine operates at a mixture 
ratio (lox/liquid hydrogen of 6: 1 and a chamber pressure of approximately 3,000 lb/in 2 absolute) to 
produce a sea level thrust of 375,000 lb and a vacuum thrust of 470,000 lb. The engines are throttleable 
over a thrust range of 65 to 109 percent of design thrust level. This allows high thrust initially with 
throttle down capability to control maximum vehicle dynamic pressure (max q) and maintain vehicle 
acceleration at a 3-g limit for crew safety. In the staged combustion cycle, the propellants are partially 
burned at high pressure and relatively low temperature in the prebumers, providing power to drive the 
high-pressure pumps. They are completely burned at high temperature and pressure in the main 
combustion chamber before expanding through the high-area-ratio nozzle. Liquid fuel or oxygen is used 
to cool all combustion devices. The hydrogen-rich hot gas from the prebumers is used to drive the high- 
pressure pumps. To put this energy concentration in perspective, the high-pressure fuel pump is a three- 
stage liquid hydrogen pump driven by a two-stage gas turbine rotating up to 38,000 r/min, and 
producing 70,000 h.p., all contained in a space of approximately 18 inches in diameter and 2 feet long. 
The output from the high-pressure lox pump is a pressure of 4,600 lb/in 2 absolute at a flow rate of 795 
lb/s, producing very high dynamic pressures. It is clear from this brief description that this system 
produces very harsh environments. Temperatures range from 1,700 to 30 °R; pressures up to 7,500 lb/in 2 
absolute; and dynamic pressures 60 times those normally experienced on the shuttle wing during ascent. 
Figure 49 is a picture of the engine, while figure 50 shows the basic flow and typical values. This, in 
conjunction with hydrogen environments, leads to susceptibility to corrosion, hydrogen embrittlement, 
high-cycle fatigue, and fracture mechanics issues. Problems have been experienced in all these areas 
during the engine development program. 


b. Creativity/Innovation . Some of the innovation and creativity brought to bear during the 
history of the SSME was discussed briefly in the shuttle paragraphs. The development and use of 
damping seals to damp turbomachinery instability and high-cycle fracture mechanics are examples. 

The main oxidizer valve (MOV) 7,000-Hz vibration problem was a classic example of 
acoustical/structural dynamic tuning and also how innovation can be used to solve a problem. The 
problem was a resonating edge tone of the valve/sleeve housing gap as the high speed lox flowed across 
it, exciting the sleeve and causing the seal to rub and catch on fire. In order to find where the excitation 
was coming from, a buzzing valve was put in the lox cold flow facility at MSFC and tested to duplicate 
the vibration experienced on the engine. Once the buzz was established, wax was put in the various 
cavities, one at a time to determine which was the excitation source. When the sleeve/housing gap was 
filled, the vibration stopped. The solution was to tailor a washer to fill the cavity. No vibration has 
occurred in the MOV since 1980. 

Turbomachinery and its ancillary field, rotordynamics, has had to make quantum jumps in 
analysis, testing, and data basing. Instabilities such as whirl, bearing life degradation, rogue force, and 
excessive vibration are evils waiting to happen in high-performance, high-density turbomachines. The 
creative use of damping seals, an invention of George von Pragenau, basically solved the whirl problems 
and reduced the forced vibration levels. Extrapolating from the damping seal concept, Von Pragenau, in 
conjunction with Rocketdyne, developed and demonstrated a hydrodynamic damping seal bearing that 
not only provided adequate damping but also was the rotor support bearing. This damping seal bearing 
concept was demonstrated for the SSME lox pump in the MSFC engine testbed. A total of five hot 
engine firings was used to demonstrate this approach. The bearing lifted off early in the start sequence, 
eliminating the concern of rub in gaseous oxygen (gox) during startup and shutdown. An innovative 
technique for balancing the spinning parts had to be devised because it was generally not possible to 
balance the parts assembled into a pump. Rotordynamic analysis with many rotor and case modes 
became routine. Nonlinear rotordynamic analysis tools were developed and used extensively. 
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Figure 49. SSME configuration. 
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Figure 50. SSME propellant flow diagram. 




Many other innovations were apparent as various problems occurred. The numerous major hot- 
fire development problems were studied and resolved using Government/contractor concurrent 
engineering teams, usually called failure investigation boards. Although the word “concurrent 
engineering” was not in vogue, the operating approach and team makeup were part of the characteristics 
of the “current” definition. (See reference 20 for a discussion of the approach.) The teams, in general, 
used fault trees or FMEA’s in a formal way to resolve very complex technically induced hardware fail- 
ures. The use of these failure boards or teams was very effective and innovative. The use of concurrent 
engineering or ad hoc teams (tiger teams) has evolved to deal with complex technical issues such as 
fatigue problems, weld problems, and special problems such as 4,000 Hz, turbine blade cracking, bear- 
ing wear, and manufacturing issues. Major technology breakthroughs have occurred in the development 
of special materials and materials processing, such as the development and usfe of silicon nitrite ball 
bearings to solve the turbomachinery bearing wear issues, 65 and single-crystal turbine blades to solve 
blade cracking issues. The development of CFD analysis techniques to predict the internal fluid and gas 
flow environment was also a major accomplishment. Parallel to this was the development of special air- 
and water-flow facilities to benchmark these CFD models. Detailed finite element dynamic and stress 
modeling reached its pinnacle for meeting accuracy requirements and performance in order to under- 
stand and solve the many fatigue issues. The extreme thermal environments and thermal gradients 
required the same level of sophistication. Materials characterization had to reach new levels due to the 
use of exotic materials, and the extreme environments created very small critical flaw sizes that drove 
many innovative, as well as more accurate, nondestructive evaluation (NDE) approaches. X ray, dye 
penetrant, ultrasonic, etc., were a part of these NDE advances. Internal instrumentation was developed to 
measure and quantify environments. Large advances were made in hot-fire data acquisition, data 
evaluation, and data banking; and electronic data transfer became standard practice. The engine system 
performance data and the high-frequency turbomachinery (vibration data) are good examples. The 
approach collects and evaluates vibration data from 0 to 4,000 Hz. Spectrums, ISO plots, RMS plots, 
mean and variances, etc., are produced and data banked. The historical datd banks of physical data 
formulated in a probabilistic and reliability sense are used to manage hardware maintenance and to 
ensure flight safety. Data exist now for over 2,000 ground tests and 80 shuttle flights (three engines each 
flight). As a result of this large data base, decisions are made for flight based on expected demonstrated 
levels and hardware successes. In general, a piece of SSME hardware will not be flown with more 
accumulated time than one-half the ground demonstrated levels. 

c. Developmental Problem Examples . SSME problems have taken many forms, some of which 
have been major failures. 35-66 The flight history program is shown in figure 51 . Figures 52 and 53 show 
the flight redlines required to safely shut down malfunctioning engines. In addition to the flight pro- 
gram, there has been an extensive ground development and verification test program involving 60+ 
engines and 2,000+ hot-fire SSME ground tests (individual engines), accumulating more than 748,000 s. 
This does not include the 10+ MPT engine cluster test and more than 80+ flights of three engines each. 
To date, there have been 36 major failures, all of which were investigated by an official investigation 
board with a self-contained report depicting the problem resolution and other recommendations. Figure 
54 shows the 36 major failures as a function of calendar year. As the program has matured, major 
failures have decreased. Figure 55 is an engine schematic showing where the failures have occurred. 
Table 4 lists the 36 failures with other pertinent data such as cutoff parameters, failure cause, and 
resolution. Dennis Gosdin created these charts together with the assistance of Rocketdyne and MSFC 
engineers to serve as a historical data base. Many other problems have occurred that were not classified 
as major failures. One occurred in proof tests, some in vibration testing, and others were self-contained. 
Many were found analytically, others are the inherent problems of high-performance systems. In the 
sections that follow, appendices, and references, many of these problems are discussed — not to point 
fingers, because all have performed very well — but to teach what can be expected in developing high- 
performance systems and to point to areas for penetration and problem avoidance (total design) in new 
programs. All in all, these liquid propulsion systems provide great complexity and challenge. This can 
be understood by the range of technical areas these system encompasses such as: rotordynamics, 
thermal, flow, control, transients, stability, fracture, fatigue, combustion, exotic fuels, manufacturing, 
FMEA’s, testing, analysis, simulations, breadboards, tractability, etc. A few examples of these 
challenging problems follow; the complete documentation is reserved for the appendices. 
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SSME HOT FIRE MATURITY 



115,511 684,964 562,809 104,913 10,803 6,958 

Figure 5 1 . SSME flight history program. 
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Figure 52. Start confirm redlines. 
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FIGURE 1. SSME FLIGHT REPLINES 



Figure 53. SSME redlines. 
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Figure 54. SSME major failures 







Figure 55. SSME schematic with failures. 


(1) SSME 4,000 Hz. Flow instabilities have been the classical problem of structural systems. 
They have taken many forms, occurring unexpectedly, taking human life. Many textbooks and technical 
papers focus on the phenomenon; aircraft flutter garners the bigger emphasis. Internal flow in fluid 
systems experiences the same instabilities. An instability is generally defined as an increasing amplitude 
structural response where the fluid force is a function of the structural deflection causing the problem. 

The SSME lox system fits the characteristics required to produce instabilities, high density-large 
flow velocities, thus, a very high dynamic pressure. Many problems have occurred in this system. The 
inlet tee to the lox dome of the main combustion chamber (fig. 56) is a classic example of what can 
happen. The tee has a two-blade splitter (flow between, and on each side of, the two vanes) designed to 
more evenly distribute the lox flow to the powerhead. On most engines (90 percent) nothing happened. 
However, on 10 percent of the engines, a high-frequency, high-amplitude (4,000 Hz, 100 g’s) oscillation 
occurred. If run long enough, the vanes crack, detuning the structure from the flow, eliminating or 
greatly reducing the response. Two types of structural elastic flow interaction are possible: (1) vortex 
shedding, and (2) flutter-type instability. Extensive effort was expanded to understand the problem 
through a team effort by MSFC and Rocketdyne for approximately 3 years. These efforts included (1) 
structural dynamic and static modeling, (2) scale-model and full-scale flow testing, (3) computational 
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Table 4. SSME major incident overview. 


Incident 

No. 

Date 

Test 

Engine 

Failure 

Cutoff Method 

Damage 

31 

7/1/87 

902-428 

2108 

OPB injector element braze 
crack 

HPFT redline lower 
limit 

Cont. 

30 

3/27/85 

750-259 

2308 

MCC outlet manifold weld crack 

HPFP accel 

Uncont. 

29 

2/4/85 

901-468 

0207 

FPB manifold crack 

Power amb. temp. 

Uncont. 

16 

7/12/80 

SF10.001 

0006 

FPB liner and housing burn 
through 

Observer 

Uncont. 

2 

8/27/77 

901-133 

004 

FPB housing bum through 

Observer 

Uncont. 

28 

2/14/84 

901-436 

0108 

HPFP coolant liner failure 

HPFP turbine disch. 
temp. 

Uncont. 

23 

10/15/81 

901-340 

0107 

HPFP turnaround duct failure 


Cont. 

27 

8/27/82 

750-175 

2208 

NPOP discharge duct failure 
(ultrasonic FM) 

HPOP PBP radial accel. 

Uncont. 

26 

5/15/82 

750-168 

0107 

OPOV leakage during cutoff 

Program duration 

Cont. 

25 

4/7/82 

901-364 

2013 

HPFP kaiser hat nut failure 

HPOP PBP radial accel. 

Uncont. 

24 

2/12/82 

750-160 

0110F 

Fuel injector blockage (ice) 

PFP turbine disc. temp. 

Uncont. 

8 

6/10/78 

902-112 

0101 

Eng. inlet fuel supply blockage 

(N 2 ) 

HPFP SPED 

Uncont. 

22 

9/21/81 

902-249 

0204 

HPFP turbine blade failure 

HPFP radial accel. 

Uncont. 

5 

12/1/77 

901-147 

0103 

HPFP turbine blade failure 

HPOP radial accel. 

Uncont. 

4 

11/17/77 

9020095 

0002 

HPFP turbine blade failure 

HPOP radial accel. 

Uncont. 

21 

9/2/81 

750-148 

0110 

MN injector lox post failure 

HPOP turbine 
discharge temp. 

Cont. 

20 

7/15/81 

901-331 

2108 

MN injector lox post failure 

HPOP turbine 
discharge temp. 

Cont. 

17 

7/23/80 

902-198 

2004 

MN injector lox post failure 

HPOP turbine 
discharge temp. 

Cont. 

7 

6/5/78 

901-183 

0005 

MN injector lox post failure 

HPOP turbine radial 
accel. 

Cont. 

6 

3/31/78 

901-173 

0002 

MN injector lox post failure 

HPOP turbine 

Cont. 

19 

1/28/81 

901-307 

0009 

FPB injector lox post failure 

Prog. C/O 

Cont. 

18 

7/30/80 

901-284 

0010 

MCC PC Lee jet failure 

HPOP PBP rad. accel. 

Uncont. 

15 

1 1/4/79 

SF6-003 

2002 

Nozzle steerhorn failure during 
C/O 

Cut by eng. 0008 HPOP 
turbine sec. seal pr. 

Uncont. 

13 

5/14/79 

750-041 

0201 

Nozzle steerhorn failure 

HPFP turbine disch. 
temp. 

Uncont. 

14 

7/2/79 

SF6-001 

2002 

MFV housing crack 

HPFP turbine temp. 

Uncont. 

12 

12/27/78 

901-225 

2001 

MOV fire due to fretting 

HPFP turbine disch. 
temp. 

Uncont. 

11 

12/6/78 

901-222 

0007 

Hex coil failure 

Hex disch. temp. 

Uncont. 

9 

7/18/78 

902-120 

0101 

HPOP capacitance probe rub 

HPOP PBP axial accel. 

Uncont. 

i 

3/24/77 

901-110 

0003 

HPOP prim, seal failure 

HPOP speed 

Uncont. 

3 

9/8/77 

901-136 

0004 

HPOP No. 3 bearing 

Facility 

Uncont. 

10 

10/3/78 

902-132 

0006 

MOV improperly installed 

MCC PC lower limit 

Uncont. 
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Figure 56. SSME lox dome inlet tee. 

fluid flow analysis, (4) fatigue and fracture mechanics analysis, and (5) structural dynamic and static 
testing. These efforts led to the conclusion that the basic instability was essentially vortex shedding. 
Figure 57 shows a typical response of buzzing and nonbuzzing engines. The first is a spectrum showing 
the very sharp narrow band resonance peak indicating an instability. Conducting a correlation analysis 
shows that the response is single-frequency sinusoidal. The fix consisted of scalloping the leading edges 
to allow more flow between the blades and tapering the trailing edge to eliminate vortex sheets. In 
addition, the frequency of the vane was raised slightly, helping to detune the system. Figure 58 shows 
the fix. Figure 57 is a plot of the response before and after the fix. 

TEST 7500262 S+140 109% 



FREQUENCY (Hz) 

Figure 57. SSME response of 4,000 Hz. 
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Baseline Configuration Modified Configuration 


Figure 58. SSME splitter fix. 

One very interesting problem occurred during the investigation. It was thought that by putting a 
structural collar on the powerhead dome, the frequency shift would detune the system and, in addition, 
provide damping, further reducing the response. The collar was hot-fired on a buzzing engine resulting 
not in a reduced response, but a greatly increased oscillation. The dynamic detuning, in reality, became 
more finely tuned, creating the increased response. 

These lessons stand out: (1) do not allow dynamic tuning in structural flow systems, (2) design 
out instabilities, and (3) realize that dynamically tuned systems are very sensitive to very small changes. 
In retrospect, it was the very small differences in the trailing edge of the vane, coupled with some 
thinning in the duct, that created the buzzer versus the nonbuzzer modal tuning. These differences were 
so slight that they were essentially undetectable through normal inspections. 

(2) ATD Lox Pump Bearing Wear and Vibration Problem. The ATD lox pump is a replacement 
of the currently used Rocketdyne turbopump with a goal of greatly reduced maintenance and operational 
cost through redesign using advanced technologies and greatly reducing the number of structural welds. 
During early developmental testing on the E-8 hot-fire pump test stand, and later full-engine ground 
testing, vibration problems occurred leading to test cutoff or engine shutdown. These vibrations 
occurred as a sharp rise in synchronous vibration triggering the health monitoring shutdown systems. 
Figure 59 shows a typical high-vibration response in g’s of acceleration. With the solution of the high-g 
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Figure 59. SSME high-vibration ATD lox pump. 

vibration problem, long-duration hot-fire engine testing could commence. As this testing began, 
excessive ball bearing wear occurred, exemplified by a rise in the bearing cavity temperature (fig. 60). 
With the solution of the bearing wear issue, long-term developmental testing resumed. Initially, some 
changes made in attempts to solve the bearing wear resulted in a reintroduction of the high vibration for 
one pump. The problem was solved by going back to the original solution for high vibration (tolerances, 
etc.). Additional testing uncovered some undesirable vibration sensitivities (not of the high-q engine 
cutoff type) that required additional solutions. The next three sections will give a brief summary of the 
high vibration, bearing wear, and vibration sensitivities issues that occurred during early ATD lox pump 
development. They illustrate the complexity of high-performance machinery development and the 
system issues that usually occur. The approach used to solve all these problems utilized a 
Govemment/contractor concurrent engineering team. The team used the standard fault tree approach 
with special subteams designed to investigate special legs of the fault tree. Formal action items and logic 
diagrams were used to keep the activities focused. About one-third of the total team’s time was spent at 
Pratt & Whitney. The rest of the effort was worked at the home offices, with a twice-a-week telecon to 
track actions and report programs. Concurrent engineering teams using fault trees are an excellent 
approach for handling these types of complex problems. See reference 65 for details. 
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Figure 60. SSME ATD lox pump temperature excursions. 
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(3) ATD High-G Vibration. Initially, the source of the vibration problem was unclear. The pump 
end of the lox pump had a damper seal in parallel (adjacent) to the ball bearing support (fig. 61). The 
damper was installed to prevent whirl; however, in achieving the damping, a stiffness level of 
approximately 400k lb/in was produced. This kept the ball bearing from contacting the housing until 
forces developed that would overcome the damping seal stiffness. This split in rotor support stiffness 
created a split force between the damper seal and the ball bearing. Several items were proposed: (1) loss 
of damping in the damper seal, (2) loss of stiffness in the damper seal, (3) nonparallel housing producing 
bearing tilt, and (4) bearing clearance. 

ATD-HIGH PRESSURE OXIDIZER TURBOPUMP 


PEBB deadband — i 


PEBB 

preload 


Damper seal 
Inducer cavitation 


Balance piston 
dynamics 



Figure 61 . SSME ATD lox pump damper seal/bearing. 

As work progressed, it was decided that the bearing sleeve had to be tapered such that the bear- 
ing did not tilt negatively. Figure 62 shows how the stiffness of the bearing is greatly reduced as a func- 
tion of negative bearing tilt. Also, it became clear that the bearing clearance was too tight, possibly cre- 
ating bearing axial hang-up. A pump was modified to ensure a flat bearing-to-housing contact and wider 
clearance to prevent hang-up. This pump ran vibration-free until it was pushed slightly outside its 
operational parameters by varying the net suction specific (NSS) pressure (increasing hydrodynamic 
forces). When pushed hard, this pump also experienced high synchronous vibration. 

While this activity was progressing, a parallel activity was being pursued in the MSFC flow 
facility to see if a reduction could be made in the impeller hydro forces through inducer changes. The 
results showed that a change in clearance had a major effect on the forces, reducing them by up to an 
order of magnitude. In addition this change was incorporated in a pump that also had the tilt and 
clearance change. This pump configuration had margin for the high-g vibration. Figure 63 is a plot of 
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Figure 62. SSME ATD lox pump bearing stiffness versus tilt. 
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Figure 63. SSME ATD lox pump build accelerations versus NSS. 
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several different pump configurations showing acceleration versus NSS. Notice that the first two fixes 
helped the vibration characteristics of the pump; however, the major fix included was the inducer 
change, which reduced the hydro forcing function substantially. Later, a pump housing redesign was 
made that eliminated the requirement of tapering each bearing sleeve (called stiff housing). 

As mentioned previously, after the bearing wear problem was solved one other high-g pump 
occurred. Figure 63 shows this response. This high-g response was caused by reducing the bearing 
clearance as a potential bearing wear fix. Increasing the clearance back up to the previous value fixed 
the problem. 

(4) Bearing Wear. With the solution of the high-g vibration problem, bearing distress became an 
ATD program-threatening issue. Some bearings were lasting several test with small wear, while others 
were wearing within 50 or 100 s. This was exemplified by a rise in bearing cavity temperature. Figure 
64 is a plot of the bearing cavity discharge temperature showing the temperature increase when the 
bearing starts to wear. Figures 65 and 66 are pictures of a bearing race showing the wear tracks. The 
balls become so hot that they turn dark. After many attempts to isolate the wear cause, a pump was built 
with silicon nitride balls while keeping the steel races. This pump showed no bearing wear. As a margin 
enhancement, special inner-race cooling and outer-race-guided cages were added. No bearing wear has 
occurred since making these changes. The story of interest is how the solution did evolve. This problem 
dramatically illustrates the many interacting factors/parameters in a complex nonlinear dynamic prob- 
lem. Bearing sets have accumulated 20,000 s of hot firings without any apparent balls or race wear. 
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Figure 64. SSME ATD lox response versus bearing clearance. 
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Unit 3-1 C Bearing Post Test Condition Summary 
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Figure 65. SSME ATD lox pump bearing wear. 



Figure 66. SSME ATD lox pump bearing wear. 


79 





There are two generic sources of bearing wear: (1) heat generation and (2) heat dissipation. 
There is always heat generation. The concern is excessive heat generation. Not enough heat dissipation 
will allow even a nominal heat generation bearing to overheat. Thus, the fault tree, or failure tree, had to 
list all the potential causes under each from lubrication, materials, to coolant. To illustrate how fault tree 
analysis can lead down blind paths until the data are collected and understood, the pump that ran the 
longest period of time had a different prelubrication treatment and still had lubrication present when the 
pump was disassembled. As a result, lubrication experts were called in and many tests were conducted 
on lubricant application before it was ruled out as a cause. A second blind alley occurred because the 
bearing rig test had demonstrated long life. These tests did not have the damper seal and had parallel 
bearing support with good bearing loads. It was thought that the damper seal caused the bearing to 
unload or that the bearing was tilting due to lack of load. The damper seal acted as a rotor support. Two 
pumps were built, one with no damper seal by the bearing and the other with a small clearance and an 
eccentric load. Both bearings wore quickly. By then, time was running out so the advanced-technology 
silicon nitride balls were installed in a pump. This pump ran many tests without ball wear. The team was 
simultaneously working on heat dissipation and, therefore, also added jet cooling (lox) to the bearings at 
the contact point and outer-race-guided cages. Both designs theoretically increased the bearing wear 
margins. 

Silicon nitride balls alleviated the heat generation and heat dissipation aspects of the problem. 
From the heat generation standpoint, the balls are 70 percent lighter, hence lower centrifugal forces 
occur. These balls have a lower coefficient of friction, therefore, heat dissipation is better. Theoretically, 
to date, the total improvement of silicon nitride balls cannot be explained; however, approximately 10 
pumps have been assembled and hot- fire tested without ball wear. Two pumps have over 20,000 s each 
without bearing balls or race wear. 65 66 

(5) ATD Vibration Sensitivity. When the problem of bearing and high vibration of the lox turbo- 
pump was solved, extensive full-duration and margin testing of the turbopump on the shuttle main 
engine were accomplished. During this testing, vibration level shifts occurred that were a concern; how- 
ever, these levels have not led to any early engine cuts or caused any known hardware damage. There is 
more than one category of these responses; however, the main concern has been the category II 
(vibration step increases by a factor of two or more) and category III (vibration step decreases of the 
same magnitude). 

Figure 67 shows a typical category II type response. Notice the step in g level from less than 1 g 
to greater than 2 g’s. These steps are not present on every test. Figure 68 is the end-to-end plots of 
several tests showing the variability of the phenomenon. There have been two major thrusts as potential 
causes. As discussed previously, the pump-end damper seal supports the shaft for a certain range of 
forces before the pump-end ball bearing stiffness becomes effective. Until then, the pump mode (one of 
the rotor criticals) is near the pump operating speed. This would make the pump sensitive to force per- 
turbations until the ball bearing clearance is reduced to zero. The second thnist has to do with the roller 
bearing and its support structure on the turbine end. Hot-fire data have clearly shown that the hot gas is 
causing the structure to snap. Figure 68 shows the temperature rise in the cavity, indicating a structural 
shift. Also, impedance of the roller bearing hardware indicates that the roller bearing is slipping. If the 
stiffness of the support is greatly reduced, the turbine mode will reduce in frequency and tune with the 
pump speed, resulting in high g’s of vibration. A simulation was developed that showed this potential. 
How the loss of stiffness occurs is still an unanswered question. With these changes, the vibration sensi- 
tivity has been eliminated. The lox pump now has over 100,000 s of ground testing and two shuttle 
flights without any bearing wear or vibration. 

(6) 2308 Failure. A different kind of structural flow interaction occurred on engine 2308. In this 
case, the hydrogen inlet tee to the main combustion chamber, which provides liquid hydrogen for nozzle 
cooling, developed a crack resulting in loss of the engine. A movie camera trained on the engine during 
static firing clearly showed the whole sequence. This was not a flow instability, but a classical forced 
oscillation resulting in fatigue failure after 20,000 s of hot fire time in a total of approximately 100 tests. 
Figure 69 shows the tee splitter arrangement and the failure location. The failure contour plot shows the 
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Figure 67. SSME ATD lox pump category II response. 
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Figure 68. SSME ATD lox pump end-to-end accelerations. 






Figure 69. SSME hydrogen inlet tee 2308. 

sharpness of the stress concentration. Stress risers occur from weld beads, sharp comers, etc., and can 
lead to problems. This failure focused attention on fatigue failures and stress risers, resulting in a struc- 
tural audit of the total engine system, the next topic. In order to totally understand the 2308 failure, 
several activities were accomplished: (1) 3-D structural static and dynamic models (original analysis 
was 2-D), (2) static and dynamic testing, (3) strain gauging of the splitter in hot fire static test, (4) 
materials testing, (5) improved flow analysis, and (6) special flow testing, water table, and special full- 
scale hardware. As was evidenced in this problem, 2-D analysis is not sufficient to account for the stress 
distributions and concentrations. Although expensive to conduct, 3-D analysis of these kinds of 
geometry is required, as well as detailed static and dynamic testing and hot fire test stress instrumenta- 
tion. 


(7) SSME Structural Audit. The 2308 failure showed that many areas such as splitter duct tee 
interfaces were susceptible to fatigue. Most of these hardware areas had inadequate analysis/test predic- 
tions. The failure investigation team recommended that a structural audit be conducted with a focus on 
long-term durability through identifying generic structural weaknesses (analysis, test, etc.) and to insti- 
tute the corrective actions necessary to enhance the confidence in flight reliability by accurate life pre- 
dictions. This effort was started prior to the STS-51L accident. After the accident, greater emphasis was 
placed on its completion to satisfy the total recertification of the shuttle, including a complete reanalysis 
of FEMA/critical items lists (CIL) and hazards. 

The audit process was carried out by a full-time independent team of Rocketdyne engineers with 
oversight review by an MSFC team. Initially, the two teams separated the engine parts into categories of 
risks according to parameters affecting hardware life. Essentially, three broad groupings were obtained: 
(1) parts that were criticality 1 on FEMA/CIL with potential short-term life issues, (2) parts that had 
long-term life issues, and (3) parts with no concerns. Obviously, category (3) parts were eliminated from 
the audit process. Category (1) had high priority, with category (2) to follow after completion of 
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category (1). The process was clear for category (1) and (2) parts. The total analysis/test reports, etc., 
would be reviewed indepth to determine the adequacy of hardware lifetime predictions, etc. This 
included a review of the materials properties, environments definition (flow, thermal, acoustics, vibra- 
tion, etc.) dynamic model, dynamic analysis, stress models, and stress analysis. It was recognized early 
by the SSME project that a large number of welds on the engine was a prime concern in the area of 
flow-cycle fatigue, high-cycle fatigue, and inspectability and, therefore, lifetime description. This area, 
weld assessment, was assigned to a special team and was not included in the audit (it will be discussed 
in the next section). 

As an aid to the audit engineers, check-off sheets were developed for each discipline review. A 
copy of these check-off sheets was available at both Rocketdyne and MSFC. Formal action items and 
action closures were installed. Deviation approval reports (DAR) were written for all parts that were 
found deficient. Several areas were found with inadequate (1) materials properties data, (2) environment 
definition, (3) dynamic analysis, and (4) stress analysis. This resulted in material testing to obtain prop- 
erties, environmental testing, special hot-fire measurements, new 3-D dynamic and static analysis, 
redesign efforts of critical parts, and DAR’s limiting use of certain parts were issued (seven ducts). 

Are structural or other audits necessary to obtain good hardware? In most cases, they probably 
are; however, the process could be greatly reduced, if not eliminated, with proper in-line reviews. The 
check sheets could be used by all disciplines. System emphasis is important. Understanding key 
parameters and their sensitivities though analysis and test is mandatory. 

A Rocketdyne document was published that describes the audit process in detail, the parts 
audited, action items assigned, and general recommendations. 64 The audit was very useful. It was used 
as a refresher for FEMA/CIL activities. Updated procedures and criteria manuals have resulted. The 
individual audits are excellent reference material for materials reviews (MR’s), etc., occurring during 
manufacturing because drawings, analysis, etc., are all collated together. The materials characteristics 
update and redesign to eliminate problem areas are still in work. The results of the structural audit and 
the return to flight activities following STS-51L led to a reassessment of the FMEA/CIL and the need to 
assess the structural welds of the SSME. 

(8) Weld Assessment. The weld assessment was accomplished by a Rocketdyne team with 
reviews by a MFSC team. The areas of concern were: 

1. Weld offset 

2. Weld notch factors 

3. Materials properties degradation 

4. Root-side inspectability 

5. High-cycle fatigue critical flaw size inspectability 

6. Manufacturing 

7. Failures and lessons. 

Because many of these welds were identified as criticality 1 failures, it was necessary that the 
risk associated with each weld be understood. This meant that each weld (criticality 1) had to be 
analyzed and understood the areas of: 
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1 . Process control 

2. Materials usage 

3. Inspectability 

4. Fracture mechanics 

a. Low cycle 

b. High cycle 

5. Environments 

a. Thermal 

b. Corrosion 

c. Loads. 

The SSME design evolved from baseline design requirements to minimize weight and leak paths 
while producing the Isp and thrust required for performance. This baselined design philosophy was: 

1 . Lightweight plus minimum leak paths 

2. Wrought, welded structure versus castings 

3. Manufacturing technology plus cost 

4. Subassembly welds versus numerical machined. 

The baselined design had no “fracture control” requirements. A fracture mechanics requirement 
plan was established in 1973 after the basic design was complete and released. In this plan, 71 parts (150 
welds) were identified as fracture critical. Instead of redesigning parts, the plan was implemented by 
NDE improvements. In addition, prior to STS-51L, welds were selectively reassessed, including (1) 
weld wire control and verification, (2) electron beam weld design, (3) vendor welding and inspection 
processing, (4) residual stress in as-welded welds, (5) geometric variables-mismatch and local stress 
risers, and (6) material properties upgrades. The CIL was expanded after STS-51L to identify all critical 
welds. A weld assessment program was established as a systematic, comprehensive evaluation of all 
critical welds to support the CIL and evaluation of future changes. 

Teams were developed at Rocketdyne to carry out the activity with a review team designated at 
MSFC. The scope of this activity was major. The program objectives were: prepare rationale for reten- 
tion for all welds prior to flight resumption based on reassessment of structural adequacy, fabrication 
process, and supporting NDE; identify and implement corrective actions as required; and establish 
a weld data base of selected design, analysis, fabrication, NDE parameters, and operation conditions as 
a rapid screening tool for future weld issues. It is not possible to convey the real magnitude of the 
effort. All the risk assessments were completed and results documented. The approach used is shown in 
figure 70. 

The total number of welds by weld type, root side access, and high and low fatigue NDE for each 
subsystem are shown in figure 7 1 . The results of the study, which was the most comprehensive and 
detailed assessment in the history of any program, showed that all welds were acceptable for flight 
resumption. The assessment provided relative ranking of most critical welds so that remedial efforts 
could be focused at the highest payoff. 
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Weld Assessment Program Objective 

• Prepare rationale for retention for all welds prior to flight resumption based on reassessment of 
structural adequacy, fabrication process, and supporting NDI. 

• Identify and implement corrective actions as required. 

• Establish a weld database of selected design, analysis, fabrication, and NDI parameters and 
operating conditions for all welds as a rapid screening tool for future weld issues. 

• Define FMEA/CIL welds— part name, part number, weld number, weld type, class, material, filler, and 
heat treat. 

• Review and summarize structural analysis — operating conditions, factors of safety, proof factors, 
and life. 

• Review and summarize fabrication process — automatic, manual, single or multipass, and 
other special conditions. 

• Review and summarize NDI processes, related detectable flaw size and requirements flowdown— visual, 
penetrant, radiographic, and ultrasonic. Specifically identify welds without root side penetrant inspection. 

• Calculate critical initial flaw size for all FMEA/CIL critical welds— compare to NDI detectable flaw size. 

• Summarize operational test history — units, starts, and seconds. 

• Photographs of sectioned hardware (if available). 

• Summarize other supporting data — lab tests, hot-fire data, and UCR or MR history. 

• Identify and implement corrective action— NDI, and planning or design changes. 

• Prepare rationale for retention. 

• Review and approve in-house and with NASA team. 

• Documented results in the SSME weld assessment report— RSS-8756 CIL summary includes weld type, 
class, and root side accessibility for penetrant inspection and detectability of critical flaw size 


Figure 70. SSME engine welds and NDI. 

The high- and low-cycle fatigue welds with unverifiable roots were cleared for flight by one or 
more of the rationales shown in figure 72. 

Figure 73 is an example of one weld to show the complexity of the problem. Notice that critical 
flaw sizes for low- and high-cycle fatigue are shown, along with the inspection technique and detectable 
flaw size. A drawing of the part is included. Documented in conjunction with these summary sheets is a 
several page write-up of process control, inspections, fracture mechanics, etc., and the rationale/risk 
assessment that allows the hardware to be used if the critical flaw size is not inspectable. The total 
documentation is approximately 20,000 pages. 

The audit has resulted in some redesigned parts having better environmental definition, improved 
inspections, and improved processing. Clearly, fracture control should be implemented in future high 
performance systems and indeed was implemented on the ATD program. Welds are a potential problem 
requiring design (1) inspectability, (2) reduced stress fields (thicker weld interfaces), (3) elimination 
where possible, and (4) robotic processing, etc. 
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FMEA/CIL Weld Statistic 










Comb devices 

1,288 

588 

93 

607(2) 

232 

1,056 

840 

732 

Turbomachinery 

801 

662 

117 

22 

313 

488 

187 

43 

Pneu controls 

1 

0 

1 

0 

0 

1 

0 

0 

Prop valves 

65 

24 

38 

3 

8 

57 

26 

4 

Actuators 

5 

0 

5 

0 

0 

5 

0 

0 

Igniter, sensors 

186 

25 

149 

12 

0 

186 

68 

51 

Lines, ducts 

701 

611 

89 

1 

210 

491 

310 

64 

POGO system 

115 

115 

0 

0 

1 

114 

3 

1 

Joints 

3 

0 

0 

3 

0 

0 

0 

0 

Total 

3,165 

2,025 

492 

648 

767 

2,398 

1,434 

895 

Percentage 


64% 

15% 

21% 

24% 

76% 

45% 

28% 

Percentage without 
LOX posts 


79% 

19% 

2% 

30% 

70% 

33% 

12% 


Notes: 

1 . Includes castings, optional welds and allowable alternate configurations 

2. Main injector has 600 inertia welded LOX posts 


Figure 7 1 . SSME fatigue rationale. 


Rationale For Retention 

• Welds where the largest undetected flaw size > CIFS were cleared for flight by the 
integrated weld assessment which included 

- The probability of detection, if less than 90% reliability and 95% confidence 

- Size, Type, and location of critical flaw 

- Surface, LCF CIFS assessed as more critical than subsurface, HCH CIFS 

- CIFS relative to typical weld pass thickness 

- Proof test 

- Process controls 

- Design validation 

- Factor of safety and life 

• Operational history 

- Number of units/total start s/total time 

- Fleet leader 

- Number of units greater than 50% fleet leader 

- Hardware sectioning/inspection results 

- UCR history 

• Engineering judgment (review process) 

- What is our experience with this material, process, and configuration from a 
fabrication and operational viewpoint? 

- How well do we know the operating environment? 

- What is the credibility of the worst case consequence of failure? 


Figure 72. SSME example summary sheet. 
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Nozzle Aft Manifold Weld Joint 
Reduction 



Present Configuration Proposed Configuration 

Figure 73. Example weld. 

(9) Engine 2206 Low Pressure Fuel Duct Bellows Failure. Engine 2206 was an engine with 90 
starts, 31,853 s, and the equivalent of 1,054 gimbal cycles. During hot-fire testing, the low-pressure fuel 
duct ruptured and started leaking. Figure 74 shows the duct, the engine duct configuration, and the 
location of the 4-in by 1-in fracture. The low-pressure fuel duct contains bellows installed to allow the 
engine to gimbal for control. The input to this duct is the low-pressure fuel pump rigidly affixed to the 
orbiter, therefore, the requirement for the bellows. The bellows have internal tripods mounted to the two 
duct attachment ends of the bellows and connected together with a ball and socket type arrangement 
(fig. 75). This allows a conjunction with the bellows and the duct to gimbal without extension due to 
internal pressure. 

Engine 2206 LPF 
Duct Bellows Failure 


IMMUf* 



Figure 74. SSME duct. 
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Figure 75. SSME bellows/gimbal. 


The preliminary failure was a high-cycle fatigue failure of one of the legs of the tripods. The 
failed tripod allowed the bellows to expand and the failed part to break a piece loose. This part flowed 
down stream, impacting the line elbow cresting the rupture and thus the leak. After impacting the duct, 
the failed part came to rest on the fuel flowmeter (figure 76). Though the bellows had passed 7 1 /2 h of 
vibration testing to the 97-percent level in each axis (each independently run) without fatigue failure, the 


ENGINE 2206 LPF DUCT BELLOWS FAILURE 
PROBABLE FAILURE SCENARIO 



Figure 76. SSME impact failure zone. 
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part failed in hot fire. One possible cause was due to the vibration criteria used for the vibration testing 
that did not include internal flow excitation because it was based on hot-fire-measured mechanical data 
at the duct ends and other locations on the engines and its parts. This is one limitation of mechanical 
testing because it is not practical to simultaneously test flow and mechanical vibration environments 
simultaneously in component verification test programs. Other possible causes, such as excessive gimbal 
angle, etc., were basically ruled out. The real cause turned out to be higher-than-predicted stress due to a 
dogleg radius that was smaller than the specification required, compounded by a reduced cross section 
and higher stress concentration (Kt) due to discrepant fabrication. One other failure of the gimbal 
occurred during DVS testing. The ball and sockets galled, and one tripod failed. This problem was 
corrected for the flight bellows. All bellows have straight shields inside the bellows to eliminate flow- 
induced instabilities. Criteria were developed during the Saturn program for these shields, thus no flow 
instabilities of bellows have occurred on the SSME program. 

Another lesson learned from the SSME audit was that environments should be well understood, 
which is not always possible due to complexities. In this case, everything was done basically correctly 
otherwise. Obviously if the system could have been designed with robustness, many problems would not 
have occurred, but this was precluded by weight constraints and performance requirements. 

References 29 through 66 discuss some of the above and other resulting problems. Other 
problems are covered in the appendix. It is clear that early decisions and arbitrary constraints determined 
the design, its operational performance, and cost, reducing the potential for flexibility in design. 
Coupling that with the high-performance system, costly marginal systems evolve. A study of the 
numerous problems documented in the matrix (by projects), the items selected examples in references 
29 through 66 and this report, demonstrates the high cost and limited margins of the hardware. Very 
little flexibility exists beyond the standard missions until the redesign efforts shown are completed. How 
one is to achieve robust optimized systems in the present austere environment is not clear; however, one 
can evaluate any part of the process from a system viewpoint and make improvements. That is the 
minimum that must be done. 

(10) SSME Conclusions. The SSME is clearly one of the Nation’s outstanding engineering 
achievements. Although it has experienced many development problems, they are not out of proportion 
to the technology readiness level at the beginning of the program, coupled with the extreme performance 
requirements it was driven to achieve, including operating at 109 percent of the original design thrust in 
order to make up for some of the performance losses created by other shuttle elements. Through this 
evolutionary history, the engine has been greatly improved. A good example of this is shown by the 
trending analysis of the high-pressure pumps vibration levels. Figures 77a and 77b show the Rocketdyne 
lox pump responses, clearly showing the effect of the damping seal introduction. Figures 78a and 78b 
are the same type plot for the Pratt & Whitney pump. Notice the sharp change with the vibration 
problem fix in mid- 1992. The same basic trends have occurred for the flight pumps (figs. 79a and 79b). 

The final SSME, including its new high-pressure turbopumps, should be completed by the end of 
1997 and will eliminate many of the problems and concerns of this wonderful high performance engine. 

Using SSME, the value of a sound ground test program has shown real merit. Future programs 
will have to have smarter ground test programs that have less tests but gamers the information through 
better instrumentation and more inclusive test parameters based on design of experiments type statistics, 
and so forth. 


89 



Grm« 


4.0 



90 








Measurements 

PBP RAD 128.1, 50. $ 129.4 

PBP RAD |1 40.6, 2l9.3 

Sa'm^re'3jze-B34""'i 

Number <if Tests- 1 56 


— o — Mean 
— ®— Std Dev 


j WLS 2-1-95 

...file..FiQ|.l.lA..PAW..i0Q%.Syn.. 
folder Static Trend! P&W 2-95 


Figure 78a. SSME P&W lox pump trend data unadjusted. 
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Figure 78b. SSME P&W lox pump trend data adjusted. 
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Figure 79a. SSME flight pumps trend data unadjusted 
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Figure 79b. SSME flight pumps trend data adjusted 


T 









3. Solid Rocket Motors/Boosters 


a Characteristics 

(1) Baseline. The SRM has evolved to the current configuration, through two earlier versions 
that actually flew on the shuttle for several flights, plus two configurations (the filament wound case and 
the ASRM) that were canceled before completion. The original motor that flew early space shuttle 
flights was replaced with the lightweight, high-performance motor (HPM) in order to gain vehicle 
payload capability to orbit. This motor flew until the STS-51L failure when it was replaced by the 
redesigned solid rocket motor (RSRM) to eliminate the O-ring problem that caused the STS-51L 
accident. The HPM is shown in figure 80. It is 146 inches in diameter, 1,500-inches (125-feet) long, and 
has a dry weight of 149,000 lb. Fully loaded, it weighs 1,260,000 lb and has a maximum thrust of 

3.600.000 lb, with a maximum internal pressure of 980 lb/in 2 . It is composed of 1 1 steel segments, 
including forward and aft domes. The segments are joined using tang and clevis factory joints at the 
factory in Utah to form four approximately equal-length segments. The four casting segments are 
shipped by rail to the launch site. The motor is assembled at the launch site using the field joints and is 
then assembled with the SRB parts, then with the other shuttle elements. The SRB parts include at least 
the aft skirt, the forward skirt, the recovery parachutes, control gyros, SRB-to-ET attach struts, and 
separation motors. The total system is shown in figure 80 and the combined dry weight of the SRM and 
SRB is 193,000 lb. 

The RSRM was essentially the same as the HPM, but had features added that solved the prob- 
lems that led to the STS-51L failure. The thrust profile (same as the HPM’s thrust profile) is tailored to 
maintain maximum dynamic pressure constraints and maximum acceleration during the latter part of the 
bum time. The first redesign change was in the field joint configuration, which went from a single clevis 
to a double clevis and an additional O-ring (fig. 81). It also had J-flaps designed in the insulation for the 
field joint that provided additional joint sealing. This J-flap was made by extending the propellant-to- 
motor insulation and changing the end configuration (fig. 82). Other improvements were made during 
the down time such as the nozzle configuration, and the ignitor. 

The SRB system was designed to be recovered using a parachute system composed of a pilot, 
drogue, and three main chutes. The main chutes went through two disreefings in order to ensure opti- 
mum performance and to reduce deployment loads. The concept was not to impact the prime SRM/SRB 
hardware design for recovery loads, but to accept hardware attrition if excessive damage occurred. Fig- 
ure 83 shows the recovery system package for flight. Once recovered, the system had to be thoroughly 
cleaned of the salt water and other impurities, inspected for damage and flaws, proof tested again for 
flight safety, and then refilled with the solid propellant. This was necessary due to the harsh reentry 
thermal and acoustic environments, water impact, and towing loads, etc. 

During the 1980’s, with the need to increase performance, the SRM programs started the design 
and development of a filament-wound case. This program went through extensive development, includ- 
ing a structural test of many specimens and the case. Various problems, including cost and a field joint 
design susceptible to the STS-51L failure mode, led to program cancellation. 

(2) ASRM. Based on the recommendation of the Rogers Commission following the STS-51L 
accident, the development of an alternate SRM was started. Advantages of the new start were used to 
enhance shuttle performance. This program was canceled for two basic reasons: (1) the RSRM reliabil- 
ity was demonstrated to be high, and (2) the NASA budget needed the ASRM funds to meet goals and 
conduct other programs. 

The ASRM (fig. 84) was also 125-ft long and slightly larger in diameter than the RSRM at 150 
in. With a weight of 1,220,000 lb of propellant and 134,000 lb of structure, the total weight was 

1.350.000 lb. It had a longer bum time and higher performance. The thrust profile was tailored, as was 
the RSRM, and burned for 140 s. The field joint was a different concept, being a bolted configuration 
(fig. 85). The gimbaled nozzle was also redesigned to solve some of the problems associated with the 
RSRM nozzle, such as erosion pocketing. 


93 



Nose Cap 


Pilot and Drogue 
Parachutes 

Forward BSMs 



Frustum 



RSRM 



r* 

i i 


il 

I i 

i 



Systems 

Tunnel 


Stiffener 

Rings 




Aft Skirt & 

Thermal 

Curtain 


TVC Subsystem 


Figure 80. SRM HPM configuration. 


94 






Major Substructure Interfaces 





Xq Station 


96 






b. Evolution/Creativitv/Innovation . Designing the SRB/SRM to maximum/minimum loads 
instead of time-consistent loads was an approach that saved redesigns and cost as the shuttle system 
evolved and loads increased. This approach early in the program was optimal since the dry weight of the 
SRM/SRB to payload to orbit was approximately 8 to 1 . This meant that approximately 8 lb of structural 
weight would only penalize the performance 1 lb. Late in the development program as loads increased, 
time consistent loads could be used to reduce stresses, thus no redesign or weight increases were 
required as the loads increased. 

In the process of reducing operational costs, it was decided to recover the SRB’s. Recovering 
these elements meant that several technologies had to be expanded and applied to this mission phase. 
Reentry aerodynamic heating drove many aspects of the thermal protection system (TPS). Special test- 
ing techniques were required to quantify the induced environments and verify the TPS. Reentry aero- 
dynamics were in the same category due to the large and fast-changing angle of attack. Reentry acous- 
tics, due to the tail-first reentry and the long cavity coupled with the large varying angle of attack, were 
in the same category. Water impact on the booster was a major technological challenge due to both the 
speed and angles of impact. Additionally, the water entry angle created air pockets around the motor that 
collapse with large forces. Understanding and characterizing the sea state was a fundamental part of the 
water impact loads. Various type drop-test programs were created, including the need for pressure 
scaling to handle the cavity collapse. The Naval Ordnance Laboratory (NOL) pressure facility was used 
for this. The system problem of dealing with various initial conditions, from SRB separation (shuttle 
trajectory variations, separation motor variations, etc.) coupled with the SRB mass properties variation, 
the atmosphere characteristics, and the parachute system, led to the Monte Carlo techniques to define the 
conditions for parachute deployment, acoustic and thermal. A technique (innovation) was developed for 
accomplishing the reentry aero acoustics testing in a continuous-flow wind tunnel where the angle of 
attack could be varied (swept) real-time. Spectral analysis was accomplished, dictating the angles of 
attack where the acoustics were tuned and amplified. Once the designed angle of attack was determined, 
the system dwelled on that angle of attack and produced the design data. 

Describing the dynamics of solid propellant was just as technically challenging in that its char- 
acteristics were very nonlinear (viscoelastic) as a function of propellant temperature, bore pressure, and 
oscillation amplitude. For application in analysis, a mechanical analogy was developed based on pro- 
pellant coupon testing. 

The ablative nozzle of the RSRM presents a major technological challenge in that it is a poly- 
meric composite that chemically decomposes from thermal and structural response. This problem is 
nonlinear, interactive, and multidisciplinary in nature, which requires a totally new innovative approach 
to formulate the problem that couples the equations of energy, mass transport, and momentum, and to 
solve the equations simultaneously. 

The use of the double clevis field joint along with the third O-ring for the RSRM was unique and 
practical since it allowed the use of all the case material already bought for the program and provided a 
joint that opened no more than 5 mils, whereas the SRM joint opened up to 35 mils. The case-to-pro- 
pellant J-seal over the field joint was also innovative. 

Dynamic modeling of the redesigned solid rocket booster (RSRB)/RSRM was very complex due 
to several factors: (1) nonlinear propellant stiffness, (2) high internal pressure stretching and ballooning 
the case, (3) pressure effects on the radial case stiffness, and (4) interface constraints (SRB-to-ET and 
SRB-to-MLP). Numerous nonlinear viscoelastic propellant tests were run to characterize the propellant 
modulus. Not only was the motor tested as a part of the full-up and 1 /4-scale dynamic test, but it was 
tested */4 scale in three different configurations as an element: (1) free-free; (2) horizontal on the SRB- 
to-ET attach struts and forward thrust post, unpressurized; and (3) configuration No. (2) pressurized. 

c. Problem Examples . Many problems occurred during the development of the SRB/SRM, 
RSRB/RSRM, and the ASRM until program cancellation. A few were unique and will be highlighted 
here. 
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(1) Reentry Problems. The separation of the SRB’s from the shuttle vehicle through the recovery 
in the ocean has experienced many problems. This phase of the SRB is very complex and has numerous 
interactions with the launch portion of the shuttle flight. In fact, this is a classical systems interac- 
tion/design problem. The SRM was not designed for the reentry/recovery events in a classical sense, but 
is assessed for attrition against launch (ascent) design requirements. This allows pushing the margins 
close, accepting some attrition and refurbishment for reflight as long as it can be shown to be safe for the 
next flight with a factor of four on life. The separation, reentry, water impact, and recovery are funda- 
mental to successful recovery and reuse. 

Problems have occurred in the areas of reentry acoustics, reentry thermal, parachute timing, 
parachute loads, parachute deployment (extraction from the nose cone), water impact loads, and SRB 
tow back. The most extensive loss was flight STS-4 where the water impact parachute release g-switch 
separated one leg of each chute at nose cone separation. Both SRB’s were lost due to the resulting high 
impact velocities. The malfunctioning of the switch was due to external shock loads from the pyrotech- 
nics for separation coupled with marginal g-switch settings. 

As has been mentioned, the reentry phase is highly coupled to the launch phase. To illustrate this 
coupling, several different areas and problems that have occurred during flights are presented. In order 
to do this, various components of the SRB need to be understood. The SRB is composed of the SRM, 
which includes the ignitor, the nozzle, and the propellant. The motor is built up from 1 1 different seg- 
ments, 4 of which are assembled at the factory (factory joints) into 4 resulting segments. These 4 
segments are assembled at the launch site (fig. 86). The SRB is composed of all the additional parts 
integrated with the SRM to produce the thrusting elements, etc. (fig. 86). The additional parts are 
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Figure 86. SRM segments and SRB elements. 
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parachutes, aft skirt, APU system, rate gyros, separation motors, range safety system, tunnels, SRB-to- 
ET attachment struts, forward skirt, nose cone, and SRB-to-launch pad attachments and separation bolts 
for the shuttle system. In addition, a thermal curtain is attached between the aft skirt and nozzle to 
protect all components contained in the aft skirt during ascent flight. This curtain is designed to break 
away during water impact in order to lower loads and not damage the nozzle. 

The thermal curtain design has been interesting. In wind tunnel testing to derive reentry acoustics 
environments, it was discovered that the curtain would flutter and break up. During development flights, 
it was decided not to design a fix for this problem, due to complexity and cost, but to accept the failure 
during reentry, as long as ascent could be verified to be safe. The curtain has failed during reentry on 
every flight, evidenced by the jump in internal temperatures that are measured inside the cavity between 
the skirt and nozzle. Insulation is used to protect these parts for this environment increase. The heat loss 
is a function of angle of attack and the separation apogee. Due to the variation in the SRB separation 
conditions, angle of attack, and H (altitude), there have been three flights with hydrazine fires caused by 
reentry environments failing the hydrazine line. This fire increases the normal reentry thermal 
environments, damaging specific components. The ASRM further aggravated this problem due to its 
higher performance, longer bum time, increasing velocity at separation by 20 percent. Since this is a 
factor of 2 in terms of thermal environments velocity cubed, major concerns existed for redesigning the 
system to handle these environments. 

Figure 87 attempts to capture this coupling between the various events. It starts with the ascent 
trajectory and its variations due to mission differences and to parameter uncertainties. These data 
become input data for the reentry trajectory analysis. This is usually accomplished using a Monte Carlo 
statistical analysis approach. The reentry trajectory determines the loads during parachute deployment, 
reentry, and water impact. Reference 39 discusses the water impact loads problem. 



Figure 87. Recovery trajectory interdisciplinary coupling. 
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The parachutes have had loads problems associated with sequencing, reefing, and deployment 
out of the forward skirt. Reentry acoustics were a major design concern. The reentry acoustics are 
caused by an edge tone across the nozzle that resonates with the motor cavity. The SRB reenters the 
atmosphere tail first and broadsided, with varying angles of attack that induce these edge tones. Two 
distinct areas of thermal environments exist, the external and the internal after the thermal curtain failure 
due to flutter. Several flights have had instrumentation that has quantified these data. 

(2) Nozzle O-Rings. In the summer of 1995, the ablative nozzle sections were found to have 
blued or scorched O-rings between the nozzle segments. Figure 88 is a cross section/schematic of the 
RSRM nozzle showing the assembly points and the O-rings. The assembly points are called nozzle 
internal joints. When these blued or scorched O-rings were found during disassembly and refurbishment 
after a shuttle flight, it was decided to delay the next shuttle flight until the problem was understood. A 
team was formed to investigate, understand, and recommend a solution to the problem. This was accom- 
plished in record time. 



Figure 88. SRM nozzle configuration. 

The problem was caused by compressed air trapped during the close-out/transition process in the 
vicinity of the sealant backfill (RTV) close-out/transition locations. It was believed to have been 
aggravated by a process change to deeper RTV back fill, which increased the gas path incidence and 
severity. Where the air was trapped created a blow hole in the RTV that provided a gas path to the 
O-ring (fig. 89). 

The team came up with a procedure change that would eliminate the problem on future builds; 
however, nozzles were already assembled and in the field and on the shuttle that needed repair. A proce- 
dure was developed and certified to take out the original RTV and reinstall it, eliminating the close out 
blow holes above the joint inflection points. This repair was implemented for shuttle vehicle STS-69 
RSRM’s on the MLP. 

(3) Aft Skirt. One major problem that has occurred on the SRB was two failures of the aft skirt 
during structural testing at approximately 1.28 times limit load, thus not meeting the 1.4 safety factor 
criteria. 


The space shuttle SRB aft skirt failure illustrates the limitations of analysis/modeling. Early 
shuttle loads analyses conducted, using simplified models of the launch pad and the SRB skirt, produced 
a set of loads thought to be accurate for the prelaunch SSME thrust buildup phase of launch. It was 
understood that a major skirt load would arise from the vehicle weight combined with the SSME 
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Figure 91. SRB radial load sensitivity. 

the symmetrical skirt showing the large peak at the weld for different load variations. Figure 92 is a 
detailed finite element stress analysis localized around the weld failure point, showing the large stress 
intensity at the weld near the bottom of the skirt. 

Part of the loads sensitivity of the aft skirt is due to the holddown mechanism, which is com- 
posed of the spherical bearing, bushing, and aft skirt shoe. The bushing is offset so that the mating of the 
SRB to the pad could be enhanced. Since the aft skirt load is a function of the radial displacement of the 
skirt due to the post deflection, this symmetry can be used to prebias the skirt post inward, reducing the 
effect of the applied load and thus increasing the structural margin. The approach is currently being used 
on shuttle flights to increase the margins. 

In addition, a lot of effort has been expended by United Boosters Technologies, Inc. (USBI) and 
MSFC engineers to design and verify a fix to relieve the stress concentration caused by the radial bend- 
ing at the forging weld interface. The load concentration, as seen on -figure 92, shows that the radial 
movement of the very stiff holddown post forging causes the bending in the skin at the weld near the 
post. In order to distribute this load through more of the skin and bridge, the weld (a simple bracket) was 
designed and built to accomplish this task (fig. 93). A bone yard skirt was taken and cut into four seg- 
ments to verify the design. Figure 94 shows how a test segment was cut from the skirt including the test 
setup. The first segment was tested to failure without the fix to verify that the segment would indeed 
match the two total skirt test failures. With this accomplished, two segments had the fix installed and 
tested to failure. The fix reduced the stress locally by a factor of two, thus restoring and surpassing the 
safety factor requirement. To date, the fix has not been implemented for flight but is ready if needed. 
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Figure 94. SRB skirt test approach. 



(4) Parachute Release G-Switch Failure. A very interesting problem occurred on STS-4. The 
parachute G-switch activated early on both SRB’s, releasing the chute from each SRB, resulting in a loss 
of both the SRB’s. The G-switch was installed to release one of the two parachute risers at water impact, 
enchancing SRB recovery. In this case, the switches were activated during the time of frustum severance 
before chute deployment during the atmospheric reentry phase. The severance is accomplished using a 
linear-shaped charge. Figure 95 shows the frustum chute package . and linear-shaped charge. The 
G-switch was mounted to the SRB skirt after the linear-shaped charge on the IEA firewall, which was 
mounted on the forward skirt reaction ring (fig. 96). The problem occurred in this manner. The linear- 
shaped charge caused a shock wave in the SRB skirt, which excited the reaction ring in its first canti- 
lever mode of 85 Hz. This drove the IEA, hence the G-switch. The G-switch natural frequency was near 
70 Hz and should have been critically damped. The G-switch response triggered the chute attach bolt, 
hence the loss of the chute performance and the SRB’s. The first three shuttle flights (six SRB’s) had no 
problem; however, STS-4 had the same problem on each SRB. Why the difference? It turned out after 
much testing (pyro and G-switch response) that all flights were near a problem. These two SRB’s 
exceeded limits because of two factors relating to G-switch damping. The temperature decreased the 
damping, and the switches were fabricated on the low damping side, but not outside the specifications. 
This, combined with the expected variation in pyro shock response, led to the problem. No one thought 
that the G-switch of such a low frequency would respond to the shock, based on the qualification test 
run without the resonant mode of the support ring, hence the problem was missed. Many months of 
investigation time were required to find the culprit, although all pieces of data existed prior to the 
failures. The problem was putting the pieces together in the proper manner. No other G-switch problems 
have occurred in the other 70 plus shuttle flights. 
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Figure 95. SRB frustum chute. 
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Figure 96. SRB G-switch mounting. 

4. External Tank. There were three designs of the ET; the first two have been operational, with 
the third to fly for the space station missions in order to meet the payload requirements of these 
demanding missions. The standard ET flew on six of the first seven space shuttle flights. It was replaced 
with the lightweight tank (LWT) in order to gain approximately 10,000 lb of payload lost in misunder- 
stood phenomena of the system. This tank has successfully flown more than 80 missions. The third tank, 
super lightweight tank (SLWT), is under development using aluminum-lithium (Al-Li) to gain another 
8,000 lb payload in order to accomplish the space station missions. 

a. Characteristics 

(1) Standard and Lightweight Tank. Since the LWT tank has been the workhorse for the shuttle, 
the characteristics of the standard tank will not be presented. The major differences in characteristics 
were the skin thickness. The ET is a major element of the liquid propulsion system. Since it essentially 
goes to orbit, its weight uncertainties and impacts are a direct impact to vehicle performance; therefore, 
it is very critical that excessive criteria and margins not be used. It has two tanks and an intertank (fig. 
97), consisting of a lox tank that is designed to contain 1,394,891 lb of oxidizer. It measures 655.5 
inches in length, with an outside diameter of 331 inches, and it has a volume of 19,563 ft 3 , with an 
empty weight of 12,350 lb. It has internal slosh baffles to dampen the propellant sloshing that couples 
with the attitude control system and antivortex baffles to dampen the vortexes of the flowing (draining) 
liquid. The tank is insulated with external insulation sprayed on the tank with an automatic system other 
than for close-outs. The hydrogen tank (fig. 98) is designed to contain 257,500 lb of liquid hydrogen. 
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Figure 98. ET hydrogen tank configuration. 

It measures 1,160.78 inches long, with an outside diameter of 331 inches, a volume of 53,518 ft 3 , and an 
empty weight of 28,000 lb. At the rear section, a large ring frame is installed inside the tank. It takes 
orbiter thrust loads from the thrusting engines and the SRB moment reaction and transfers them into the 
tank wall. In addition, there are longhorn stringers in this section, 187 inches long, to further handle the 
orbiter-induced thrust loads by distributing them throughout the tank skin. 

The intertank (fig. 99) is the ET structural connection that joins with both the lox tank and the 
hydrogen tank to provide structural continuity between these assemblies. Its primary function is to 
receive and distribute all thrust loads from the SRB’s and transfer loads between the propellant tanks. 
This is accomplished using a massive box beam across the tank diameter, with SRB forward attachments 
on each end of the beam. The intertank also functions as a protective compartment for housing the 
operational instrumentation and range safety components. In addition, it provides an integral ET inter- 
tank carrier plate assembly that interfaces with the fluid, electrical, and pneumatic system ground facili- 
ties, a nonstructural access door, two pressure vent openings, and aerodynamic fairing for the lox 
feedline, the gaseous hydrogen (GH 2 ) pressurization line, and two electrical cable trays. 

The intertank cylindrical structure consists of eight 45° mechanically joined panels (two thrust 
and six external stringer-stiffened skin panels), a main ring frame, four intermediate ring frames, and the 
SRB beam assembly with two forged thrust fittings. It is 220 inches long, has a 331 inch outside 
diameter, and weighs 12,200 lb. 

The pressure tank is made essentially of 21 19 aluminum (Al). The process takes the forgings and 
rolls them into large panels, which are then machined to the basic stress field in order to save weight. 
The panels are shaped then welded, using large forms to maintain shape. There is over one-half mile of 
welds in the total tank. 
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DESCRIPTION 

The intertank is the ET structural connection 
that joins with both the LO% and LH2 tanks to pro- 
vide structural continuity between these assemblies . 
Its primary functions are to receive and distribute all 
thrust loads from the SRB’s and transfer loads be- 
tween the propellant tanks. The intertank also func- 
tions as a protective compartment for housing the 
operational instrumentation and range safety compo- 
nents. In addition, it provides an integral ET inter- 
tank carrier plate assembly that interfaces with the 
fluid, electrical, and pneumatic systems ground facili- 
ties, a nonstructural access door, two pressure vent 
openings, and aerodynamic fairings for the L0 2 feed- 


line, the GH 2 pressurization line and the two electri- 
cal cable trays. 

The intertank cylindrical structure consists of 
eight 45-degree mechanically joined panels (two 
thrust panels and six external stringer-stiffened skin 
panels), a main ring frame, four intermediate ring 
frames, and an SRB beam assembly with two forged 
thrust fittings. 

The use of the intertank makes it possible for 
the ET to have separate propellant tank bulkheads, 
avoiding the design complexity and added operation- 
al constraints associated with a common bulkhead 
configuration. 



Figure 99. ET intertank. 

(b) Super Lightweight Tank. The decision to join with the Russians for the design of the 
International Space Station ( ISS ) created the need for a 51V2 0 orbit inclination. The shuttle, in its present 
configuration, cannot deliver the complete ISS elements into that orbit without performance 
enhancements. A major step in performance enhancements can be made by substituting aluminum- 
lithium (Al-Li) for the current 2219 A1 in most of the tank structure. Also, further gains can be made 
through the use of an orthogrid structure milled into the tank panels. Approximately 8,000 lb of payload 
enhancement can be achieved with the SLWT. The tank’s basic geometry does not change; however, the 
material does, as well as going to the orthogrid as mentioned above. Figure 100 shows the changes in the 
fuel tank. Figure 101 depicts the intertank. Figure 102 shows the lox tank changes. The critical design 
challenges for SLWT have been: (1) welding and weld repairs, (2) achieving a proper fracture 
toughness, and (3) ratios of ultimate to yield materials properties. All these will be discussed. 
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Figure 100. Fuel tank changes for SLWT. 
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Figure 102. ET SLWT lox tank changes. 


As stated previously, the tank is a prime part of the liquid propulsion system in that it contains 
level sensors, the pressurization system, etc., as shown on figure 103. It also contains the tumble valve 
for ensuring that the ET tumbles and breaks up as it enters the atmosphere and that resulting pieces stay 
within a safe footprint in the Atlantic Ocean and do not impact land. 
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Figure 103. ET pressurization system. 


115 



b. Evolution/Innovation . Many innovative processes, as well as design concepts, had to be 
developed in order to meet the stringent performance goals without compromising safety since the space 
shuttle is a manned vehicle. The first of these was the fracture control plan and its implementation, 
which is required to ensure that no failure (tank rupture) would occur during flight. There are several 
aspects to this plan. (1) NDE techniques had to be verified for this application and expressed as a typical 
probability of detection (POD). The welds are dye-penetration inspected and x-rayed. (2) Each tank is 
proof-tested at ambient, which not only screens for critical flaws in the structure, guaranteeing a flight 
without failure with a life factor of four, but also tests the structure to near ultimate when the cyro prop- 
erties are taken into account. (3) The tank is designed for leak-before-burst for nearly all welds. Where it 
is not, or where it is not properly proofed, the rewelds are x-rayed again. (4) Substantial analog testing 
of each skin thickness with welds, where a flaw is grown by fatigue to critical flaw size, then is tested 
through mission profiles until failure. At least a factor of four must be obtained for the lowest of the 
family tested. (5) A Government and contractor fracture control board, composed of stress, fatigue, 
materials, and NDE experts, reviews each reported flaw for flight safety. (6) All flaws found during 
manufacturing (x ray and dye penetration) are repaired before final assembly and proof testing. 

Probably the most innovative design feature of the LWT was the reduction of the standard safety 
factor from 1.4 to as low as 1.25. The reduced factor was based on the degree of knowledge of the loads, 
i.e., longitudinal acceleration and internal pressure loads. If the load included all these loads, then a 
factor of 1.25 was used. If the load was mixed with 90 percent well known and the other 10 percent not 
well known, then a factor of 1.29 would be used. This approach, along with milling the skin to 
approximate the stress field, increased vehicle performance by 10,000 lb. 

Robotics automation of spraying the insulation on the tank produces a more uniform coverage 
and less potential for debonding. The same uniformity has been achieved for much of the average weld- 
ing using robotics. 

c. Problems . A tank problem matrix that lists many of the problems experienced is given in the 
appendix; however, a few of the major and typical ones are discussed below. 

(1) One problem was the aft hydrogen tank rear section oil canning during dynamic testing. 
During full-scale dynamic testing of the all-up shuttle vehicle to verify the dynamic modes calculation, 
the rear of the hydrogen tank started oil canning as the SRB’s rolled against the struts that connected 
them with the tank. The cause, when understood, was quite benign and would cause no problem. Prior to 
filling the tanks with cryo fuel, the overall tank is several inches longer than it is when loaded with cryo 
and it shrinks due to the lower temperature. In order to compensate for this shrinkage, the SRB struts are 
canted 7° so that when the tank cyro shrinks, the struts are perpendicular to each element. This 7° angle 
was enough to roll the large ring frame in the aft of the tank. When perpendicular, the rolling does not 
take place. 

(2) A problem related to the above is the pinch load introduced by the cyro shrinkage radially 
and longitudinally putting a large load into the tank structure. Early in the program, the struts were pre- 
tensioned to reduce and balance this load. Later, the tank was designed to handle the load. The thermal 
deformations are stored in the structure as potential energy, which is released as a part of the lift-off 
dynamics. 

(3) To save cost and handling, it was decided to replace the tank nose cone made of A1 with a 
composite nose cone. Two problems occurred with this design. The first was caused by a lack of under- 
standing of the coefficient of expansion difference between the composite and the A1 to which it was to 
be mated. The loads introduced would fail the nose cone when propellant was loaded. The second had to 
do with mating the holes with the top of the lox tank. In both cases, it was a breakdown in systems 
focus, where each discipline did its own thing without communicating with the others. 

(4) A very interesting problem occurred during dynamic testing of the lox tank with various 
levels of propellant fill. When the tank was full to two-thirds full, the damping of the dynamic modes 
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was basically zero; however, for less full tanks the damping was above '/2 percent, which is typical for 
this type structure. Figure 104 shows the observed damping versus fill level. The cause was a tuning 
between the fluid and structures modes — a true hydroelastic effect. This modal damping was used in the 
control/sloshing analysis that sized the antislosh baffles. 
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Figure 104. ET hydroelastic mode damping. 

(5) Another problem was buckling. Development of propellant tanks has generally had to deal 
with buckling instability. Buckling is a very difficult problem to analyze since small eccentricities 
greatly magnify the instability in a nonlinear manner. The ET development, although keenly aware of 
the buckling potential, had a buckling occur during testing. This was due to the tank having to trim as 
much weight as possible to gain shuttle performance (1 lb of tank equals approximately 1 lb of payload 
to orbit). The first occurred during the mated ground vibration test program (MGVT). It occurred while 
draining the lox tank (water) in order to simulate a flight condition (fig. 105). Operational procedures 
have been changed so that this buckling is never experienced on the pad during launch operations. 
Figure 106 is a sketch of the buckled area. 

(6) Two major problems have occurred on the SLWT during development: welding and weld 
repairs, and achieving the fracture toughness desired for fracture mechanics safety. Special techniques 
have had to be implemented for the welding and weld repair processes that include not only speed and 
proper forms and clamping, but also the use of backside purging, weld sequencing, and weld planishing 
to reduce residual stresses. Planishing can, however, be a problem in that it can also cause the weld to 
crack. Today, the fracture toughness is achieved by a very strict process control that deals with the 
material’s chemical makeup and the heat treating, along with a lot acceptance of each ingot/panel. All 
panels that do not meet fracture toughness requirements are discarded. 
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MGVT BUCKLE LOCATION 



Figure 105. ET MGVT lox tank buckling. 



Figure 106. ET MGVT lox tank buckle description. 
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(7) SLWT Verification Program. Since the basic difference between the LWT and the SLWT 
was a material substitution with no changes to the basic components, it was felt by the technical 
community that a shortened test verification program could be achieved. Particularly, it was highly 
desirable that an all-up cyro tank test to failure be eliminated due to schedule impacts and excessive 
costs. The elimination of the cyro test program was challenged by two oversight committees, one of 
NASA origin, the other of Martin Corp. sources. In order to deal with the issue, a blue ribbon team of 
experts from the various NASA Centers and the Martin Corp. were formed to study the challenge and 
recommend to the program a cost-effective safe program to proceed with. 

The team performed an indepth review of the proposed SLWT test program and compared it 
with the standard weight and LWT programs. In conjunction with this verification plan, a comparison of 
all tank panels and parts was made of the thickness, milling, etc., for each in order to determine where 
prior testing was applicable. Figure 107 shows a comparison of these three test programs (the SLWT 
program is the one available at the time of the teams formation). The team then established a modified 
SLWT test verification program. The SLWT structural verification team developed the following 
philosophies that it used in forming the verification program. 

• Verify by test, for each structural element, the integrity of the structure 

• Test demonstrate structure will withstand ultimate loads; or test demonstrate structure will 
withstand limit load and validate analysis accuracy and conservatism used to extrapolate to 
ultimate load 

• Test can be omitted if the factor of safety (FS) > 2.0 

Structural Verification 

ET Structural Test Evolution 


• Element Component Tests 

- Orthogrid panels 

- Frame webs 


• Major Development Tests 

- 10% scale slosh 

- Forward and aft SRB attach fittings 

• Subassembly Strength Tests 

- ET/Orbiter interface hardware 

- LO 2 slosh baffle 

• ST A Program 

- Intertank static strength 

- LO 2 static strength 

- LH 2 static strength 

- LO 2 Modal survey 

• Ground Vibration Test Program 

- Full scale ET 

• Components Qualification 

- Static strength 

- Vibration 

• Secondary Structure Verification 

- Static strength and capability 

- Vibration 

• Proof Tests 

- LO 2 tank 

- LH 2 tank 

- Propulsion lines 


• Development/Verification Tests 

- LH 2 skin stringer panels 

- 2058 frame stability 

• Interface Hardware Bench Tests 

- Forward and aft SRB fittings 

- Forward and aft SET/Orbiter hardware 

• LWT-1 Influence Coefficient Test 

- 2058 frame Stiffness 

• LWT-2 Limit Load Test 

- Aft LH 2 barrel and frame 

• New/Changed Components Qualification 

- Static strength 

- Vibration 

• Secondary Structure 

- Static strength and capability 

• Proof Tests 

- LO 2 tests 

- LH 2 tank 

- Propulsion lines 


• ALTA Verification Tests 

- Flight equivalent loads 

- Flight configuration barrel 

- LH 2 orthogrid panel stability 

- Proof test 

• SLWT-t LH 2 Limit Load Test 

- Similar to LWT-2 test 

- Influence coefficient test 

- Barrel panel stability 

- Aft dome pinch load stability 

• New/Changed Components Qualification 

- Static strength 

- Vibration 

• Secondary Structure 

- Static strength and capability 

• Proof Tests 

- LO 2 tests 

- LH 2 tank 

- Propulsion lines 


Figure 107. ET structural test evolution. 
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• Test not required if similar, more critical, structural element has been tested or LWT flight 
verified 

• Test article will be built on production tooling with production processes 

• Test article will be fabricated from material acceptable for production hardware 

• Test completion is precursor to flight 

• Cyro effects will be verified by material coupon testing, data gathered from the SWT testing, 
analysis, and Kennedy Space Center (KSC) tanking test. 

Implementation of this philosophy is accomplished by a variety of methods that include: 

• Membrane thickness increase — SLWT thickness is maintained at flight-verified LWT 
thickness in select stability critical regions. 

• Independent Analysis — MSFC is performing independent analysis of the intertank, and 
Langley Research Center (LaRC) is performing independent analysis of the lox tank; provides 
increased confidence in design adequacy, particularly in areas where factor of safety >2.0 
criteria are used. 

• SWT Structural Test Article (SWT STA) — The SWT ST A demonstrated loads with cryogenic 
temperature and temperature transients when loading; data and experience if being built upon. 

• Component Test — A series of 12 groups of components tests being performed to demonstrate 
or verify substructures; examples include hydrogen tank orthogrid panel compression tests, 
intertank skin-stringer/joint compression tests, stress concentration tests, and intertank 
crossbeam web tests. 

• Aluminum Lithium Test Article (ALTA) — A structural test article consisting of a 20-in barrel 
representative of barrels 3 and 4, Z panels of barrels 1 and 2 of the hydrogen tank, a hydrogen 
tank aft dome, and a lox tank aft dome; demonstrates orthogrid panel stability to ultimate and 
capability loads, stability of lox tank aft dome, and 1 13 percent of limit load in tension for 
forward hydrogen tank barrels and aft dome. 

• Proof Test — Performed on each hydrogen and lox tank; demonstrates strength of each tank 
pressure wall to 1 1 3 percent or greater of limit load. 

• Protoflight Test — Performed on each hydrogen tank; demonstrates stability of tank barrels 1 
and 2 in the vicinity of the longeron and aft dome stability to 115 percent of limit load; 
demonstrates strength of longeron region including welds of adjacent panels. 

• Tanking Tests — Demonstrates prelaunch conditions to limit load. 

Figure 108 shows this in a flow block diagram format as used by the team to asses the risks 
associated with the approach. The innovative approach added to the program twofold: first, the hydrogen 
tank proof test was augmented to include protoflight test at 1 15-percent external loads to verify stability; 
second, the increase in material thickness to match LWT for buckling. In addition, LaRC and MSFC are 
conducting independent buckling analysis. Figure 109 is a matrix of the total plan that ensures a safe 
tank for flight. The concern over no cryo tank test was handled by conducting a series of cryo coupon 
tests and extrapolating the data to flight conditions. This is possible since the basic material 
characterization change is in strength and modulus, thus the resulting thermal-induced stresses and the 
basic tank configuration did not change and were shown to be low. 
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Verification Risk Assessment Approach 


Total Tank Total Tank Parti al/Comptementarv 



• Assess risk of not performing complete STA tests for individual parts 

• Assess risk of combined element and total tank tests versus STA tests 


Figure 108. ET test verification flow. 
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Super Lightweight Tank (SLWT) Structural Verification 


SLWT Lead Engineer 


Verify the integrity of each structural element by test. 

• Demonstrate the structure to ultimate load, or alternatively, demonstrate the structure to limit load and validate the 
analysis accuracy and conservatism to extrapolate to ultimate load. 

• Test is not required if similar, more critical hardware has been test or Lightweight Tank (LWT) verified. 

• Test can be omitted if Factor of Safety ;> 2.0. 
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An aggressive, test based, verification program has been established and is being executed for the SLWT program. 
The program builds upon the existing test base of the External Tank Structural Test Articles. 

Testing completed to date has been successful. 

A challenging verification program lies ahead of us. 

Successful completion of the program established will assure a SLWT which Is safeTo fly. 


Figure 109. ET test matrix. 
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In summary, the SLWT has an aggressive test-based verification program that is being executed 
and includes: 

• Proof test for strength of the lox and hydrogen tanks 

• ALTA and protoflight testing of each flight tank for stability 

• ALTA thickness increases and independent analysis for stability of the lox tank 

• Component tests and independent analysis for stability of the intertank 

• Component tests for frames and substructures. 

Successful completion of the program established will assure an SLWT that is safe to fly. 

(8) Insulation debond on the nose of the lox tank was a major problem early in the program. It 
was believed to be a debris source that damaged the frail orbiter reentry heat protection tiles. This prob- 
lem was caused by the thermal gradients between the TPS and the substrate that was being driven 
thermally by the cryo lox temperatures. Through proper layering of materials and better bonding, the 
problem was solved. It serves as a good example of how an insignificant problem on one element can 
lead to a serious problem on another element and to the system. 


G. Hubble Space Telescope 

1. Characteristic . The Hubble Space Telescope (HST) is the world’s largest and greatest orbiting 
optical telescope. 68 Its accuracy and precision are unprecedented. Even with the problem of aberration 
of the mirror, which has been partially corrected, its contribution to science and our understanding of the 
universe has grown by leaps and bounds. The pointing accuracy of 0.007 arc s, which is equivalent to 
focusing on a dime from Washington, DC, to Boston, is unequaled in the optics world. The HST (fig. 
1 10) is composed of the outer protective shell (called the SSM), the momentum wheels that control the 
vehicle by varying each wheel’s speed, and the aperture door for blocking direct sunlight from the 
instruments, allowing more science time. The inner parts are the heart of the optical telescope assembly 
(OTA) system composed of the metering truss mounting, the primary and secondary mirrors, the focal 
plane structure, and the aft truss mounting the scientific instruments. Figure 1 1 1 shows an exploded 
view of the OTA with the scientific instruments. To eliminate thermal distortion in one direction, the 
OTA frames are built of composites that have near-zero coefficient of thermal expansion (CTE) in the 
longitudinal direction. The mirrors must be accurately located relative to each other driving this CTE 
requirement. The light enters striking the primary mirror, which focuses it on the secondary mirror. The 
secondary mirror focuses the light back through a hole in the center of the primary mirror onto the 
scientific instruments. The instruments are: (1) the fine guidance sensor, (2) the faint object spectro- 
graph, (3) the wide field planetary camera, (4) the photometer, (5) the high-resolution spectrograph, and 
(6) the faint object camera. They function to perform the fine pointing and to gather various scientific 
data for studying the universe (fig. 1 12). Power is provided by solar arrays in conjunction with storage 
batteries. The control system uses six rate gyros and two fine guidance optical sensors to provide roll, 
pitch, and yaw information, and is designed to the observatory, accurately locked to within the 0.007 
arc s on a subject for extended periods. This is equivalent to a 1 .22 -cm offset at a distance of 600 mi 
(1,000 km). Temperatures within the telescope are controlled actively and passively to assure pointing 
accuracy and structural stability. The system was designed for maintenance and refurbishment on-orbit 
at approximately 5-year intervals. The first of these repair missions has already occurred as a result of 
the aberration problem. During that mission, the solar arrays, batteries, rate gyros, and fine guidance 
sensor were replaced along with the aberration correction lens. 
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Figure 1 10. HST characteristics. 


2. Evolution/Creativity /Innovation . The prime technology driver for HST was the very high 
pointing accuracy, which required several breakthroughs and developments: (1) development of the 
pointing control logic and mechanism, including the fine pointing instrument (sensor), momentum 
wheels, and vibration (modal) suppression; (2) development of low-force isolation techniques for 
mechanical systems such as the momentum wheels (verification of these isolation systems required 
innovative testing and data evaluation techniques); (3) development of composite materials that would 
have near zero CTE in the longitudinal direction (you do not get something for nothing, so the low 
expansion in one direction created deflections in the other directions, creating a major joint design 
effort); (4) understanding and verification of the modal characteristics for both pointing while on orbit 
and accurate loads predictions during launch and transportation; (5) accurate and efficient thermal con- 
trol systems to protect the sensitive instruments and maintain pointing accuracy; (6) long-life mechani- 
cal and electrical systems; (7) solar energy system to provide power to operate the system on orbit; and 
(8) on-orbit servicing. 

The solar arrays, supplied by the European Space Agency (ESA), created impulses to the system 
when going through the day /night and night/day terminator due to thermal snap. Interaction with the fine 
pointing system was many times more than would have been for the case for healthy solar arrays. 
Reference 67 discusses this problem and its solution with the new arrays that were installed 
during the repair mission. Flight data served to identify the troublesome modes, and a new 
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Figure 112. HST solar arrays. 

control law/stabilization filter was designed. The up-linked control changes enabled NASA to meet the 
HST pointing specifications during the 2 years of operation before the repair mission. Over 20 structural 
modes were suppressed with the new control law. This is the largest number of modes suppressed with 
one control law and control system to date. The next section dealing with problems will discuss further 
the items identified and the innovations applied. 

Probably one of the great innovative achievements of the Hubble program was the repair mis- 
sion, which not only required creativity for the mirror aberration solution, but required the best that man 
could accomplished in space EVA’s — first to capture the Hubble, then to repair it. The national cover- 
age and interest in this mission alluded to its complexity and accomplishment. 

Another creative achievement occurred late in the ground-verification portion of the program 
when it was decided that the free-free modal test performed on part of the system, which adequately 
verified the on-orbit configuration, had not verified the modal characteristics for the transportation con- 
figuration when Hubble was attached to the orbiter payload bay. To test the total final assembled tele- 
scope in the constrained mode would be at least very risky and very costly to the program. This problem 
was solved by some very innovative workers, 67 which showed that a low-level impedance test of the 
orbiter telescope attach points with the final Hubble configuration would adequately provide the missing 
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data. The technique was demonstrated on simulated hardware, then the Hubble was successfully tested. 
The data were excellent. The approach was not only a great cost saving (the all-up test cost $10 M, 
impedance test cost less than $ 1M) but greatly reduced the risk of damage to the flight hardware. 

3. Problems 

a. Mirror Aberration . The largest impact problem that occurred on HST was the mirror aberra- 
tion that was caused by improper grind measurement tools that created a small error on the outer por- 
tions of the mirror. Figure 113 shows the basic problem and the results it created. The problem did not 
degrade all the science. The frequency spectrographs were not affected. A problem of this type shows 
what negative publicity can do to an organization. To fix the problem, an innovative lens was developed 
that corrected the aberration with a small loss of power. This design was probably the major innovative 
device for Hubble. The repair mission was also one of the most exciting, with national interest and 
television coverage. Much training in the Neutral Buoyancy Simulator tank was required for the 
astronauts in order to achieve overwhelming success. Figure 1 14 shows images taken before and after 
the lens correction and shows how well the fix worked. 


The "best* focus for a beam containing spherical aberration lies somewhere between 
the marginal and paraxial focus. 



Lens 


Figure 113. HST spherical aberration. 

b. Solar Terminator Excitation . After discovering that Hubble had an aberration problem, it was 
mandatory that as much science as possible be salvaged until a repair mission could take place. In the 
process of tuning up the pointing control system, it was clear that every time Hubble moved from day to 
night, or night to day, a large disturbance occurred, upsetting the pointing system and disturbing the 
observations. 
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Figure 1 14. HST picture before and after repair mission. 



Two parallel efforts were carried out to understand and solve this response problem. First, 
detailed simulations of the spacecraft with the pointing control system were conducted along with data 
evaluation of the flight data in order to develop a control logic software change that could be uplinked 
and that could solve this problem and save science. 67 Second, an effort was made through ground test 
and analysis to understand or isolate the disturbance cause. This information would also help design a 
fix to be carried up and installed during the repair mission. 

The major problem was caused by the solar array bi-stem jerking due to thermal expansion. The 
thermal deflections of the bi-stems resulted in mechanical binding and slippage, which occurred as the 
telescope passed in and out of direct solar radiation. This sudden mechanical response induced torquing 
disturbances to the HST’s pointing control system. The ESA, the solar array vendors, conducted thermal 
analysis and tests to address these deflections and the sudden mechanical response that had not been 
predicted. 

Once the problem was identified, ESA first conducted detailed thermal analysis, which basically 
confirmed results found during the design phase. In addition, MSFC and Lockheed conducted parallel 
analysis with almost the exact results for the temperature predictions. Next, ESA conducted simulated 
solar radiation testing to evaluate the bi-stem response. Much work was also accomplished at the 
Marshall Center from the dynamics and control organizations, as well as the thermal analysts, to help 
understand the problem. 67 As a result, the understanding of the mechanical response was achieved and 
ESA designed a replacement solar array that would solve the problem. The faulty arrays were replaced 
during the repair mission with this new array. No further problem of this type has occurred in Hubble’s 
mission. 

The control personnel at MSFC were able to design a control logic that would dampen the 
oscillation, so that good science could be obtained while waiting for the repair mission to take place. 
The damping of this disturbance was achieved at a much greater degree than expected, and the software 
was data-linked up to Hubble, saving the science until the repair mission. 

There are many lessons in terms of understanding multidisciplinary interactions as well as testing 
to the extent possible on ground. The designer should also pay much attention to the design of bi-stem 
deployable rods, which are necessary (or some variation thereof) for collapsing arrays for transportation. 

c. Designing for Low CTE and Other Design Issues . Highly accurate large space optical systems 
are very sensitive to distortions and misalignments. One of the main sources of these disturbances is the 
thermal expansions and contractions of the structure in the severe space environment. The approach 
taken for Hubble was to build the basic truss structure out of composites where the CTE could be made 
very low in the critical directions. This does not come for free, and many problems resulted. Carl Loy 
(retired), one of the structural designer’s at MSFC, provided a history of these problems. The following 
are some excerpts from notes he provided the author. 

(1) Metering Structure Joints. The first metering truss built by Boeing had a major problem with 
the joints due to the laminate lay-ups transferring the loads for the low CTE direction into the other 
planes. If the laminate is oriented such that its plies are perpendicular to, and the laminate makes up a 
portion of a dimension that is to be controlled by near-zero CTE effects of the composite lay-up, the 
expansion/contraction of the laminate thickness will tend to overwhelm the low CTE of the structure, 
compromising the remainder of that dimension (fig. 115). This is because the CTE of the laminate 
through its thickness is controlled by the matrix material, i.e., the epoxy. The CTE of the graphite fibers 
perpendicular to the fiber length is also quite high. The solution to the problem was to remove the 
laminate thickness from the “line of action” in the dimension that is to be CTE controlled (fig. 1 16). The 
flight metering truss, the gusset plate that joins the strut in adjacent bays, passes through a slot in the 
web of the ring. A clip is used to tie the ring to the gusset to maintain the location of the components. 

(2) Secondary Mirror Support Structure. The secondary mirror support structure under thermal 
deflections deformed the alignment between the primary and secondary mirrors. The metering structure 
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Strut/Ring Joint Configuration in the 
Boeing 3 Meter Metering Truss 




Figure 115. HST shelf. 


Strut/Ring Joint Configuration in the Boeing 
2.4 Meter (Flight) Metering Truss 



design with the secondary support structure was located forward of the forward ring of the metering 
structure (figs. 1 17 and 1 18). The primary reason for this structural arrangement was to save weight in 
the metering structure. However, it was observed that a thermal change resulting in a uniform contrac- 
tion or expansion of the diameter of the forward ring of the metering structure would move the secon- 
dary mirror forward or back along the longitudinal axis of the metering structure. A thermal gradient 
across the diameter of the forward ring will, in addition to the pumping action mentioned above, also tilt 
the secondary mirror with respect to the longitudinal axis of the metering structure. Both of these effects 
were noticed during the tests on the Boeing 3-m metering truss and the General Dynamics half-scale 
metering shell. The thermal gradient was sufficient longitudinally. The solution to the problem was that 
the secondary mirror support structure was redesigned so that it was symmetrical, forward and aft, about 
the plane of the forward ring of the metering structure. That is, no bending or flexing of the support 
structure will occur due to the thermal expansions/contractions of the metering structure (fig. 119). 
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Figure 117. HST mirror deflection. 


Secondary Mirror Support Structural Arrangement 
for the Boeing Flight Metering Truss & the Air Force 
Modified GD/C Half-Scale Metering Shell 



Plane of Forward Ring of metering structure 
coincident with plane of the structural 
support of the Secondary Mirror 


Figure 1 18. HST secondary mirror. 
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Field Splice/Shell Configuration In the GD/C Half-Scale 
Metering Shell as Modified by the Air Force 
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Figure 119. HST modified truss. 

(3) “Bathtub” Fittings. The original design had “bathtub” fittings at the fine guidance sensor, and 
the radial scientific instruments (Si’s) points B and C latch locations (the focal plane side of each of 
these points, i.e., the fixed half of the latch) were bolted to these “bathtub” fittings. All of the fittings 
failed (three were tested) well below the design load. The failures were all in the length of the edge of 
the fitting (fig. 120). The failure was due to the fact that the design did not place any graphite fibers in 
the comer areas, i.e., in the areas indicated by N on figure 120. In others words, there was no graphite 
reinforcement, but only epoxy, tying the base plate to the gusset plates on either side, where the failure 
occurred. These failures occurred at such a time in the program that it was deemed feasible not to try and 
remedy the design, but to replace the “bathtub” fittings with titanium-machined fittings having the same 
configuration as the composite fittings. This was a good trade since the reinforced composite fittings 
would weigh approximately the same as the titanium fittings. 

Configuration of “Bathtub" Fitting in 
Flight Focal Plane Structure 



Figure 120. HST bathtub fitting configuration. 
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(4) SSM Aperture Door and Aft Shroud Bulkhead. The SSM aperture door and the aft shroud 
bulkhead structures were of aluminum honeycomb construction; both were flat and both were of large 
dimension in length and width. The thickness of the honeycomb core of the facings is typical, though the 
facings on the aperture door approach a thinness that requires very careful handling for the large sheets 
used. 


Inspections of these two sandwich structures, after they were completed, indicated an area of 
debond — critically so in the aperture door — and several “dings” in both structures. The inspection 
reports, the manufacturing and bonding methods, and the processes and procedures were extensively 
reviewed by Marshall personnel experienced in all of the affected disciplines. Both of these structures 
were built in the Lockheed Burbank Aircraft facility, which has considerable experience in building 
aluminum honeycomb structures; however, the aperture door and aft bulkhead were larger than any 
honeycomb structure they had previously built. This lack of experience with that size honeycomb con- 
tributed to the poor quality of the finished product. Also, the bonding tool used probably contributed to 
the final quality of the product. 

The solution to the problem was to analyze the aft bulkhead and accept it due to the smaller 
panels created by the internal panels reducing the size of the debonds. The aperture door was rejected as 
beyond repair, and a new one of much-improved quality was produced. The rejected door was used as a 
substitute for the flight door in the various test programs until time to ship the Hubble to the launch site. 

d. Thermal Vacuum Testing (TVT) . Thermal testing of such a large spacecraft with subsystems 
integrated from many different contractors was indeed a challenge. There was an abundance of 
knowledge and experience gained during the course of Hubble’s TVT testing. As with any TVT, the 
amount of instrumentation was limited and continued to be a concern until testing. The successful 
completion of Hubble’s TVT, followed by math model correlation to the measured data, proved that 
adequate instrumentation was provided and could serve as a valuable guideline for future testing of this 
magnitude. The Hubble’s TVT can also serve as a very good example of environment simulation using 
infrared (IR) lamp arrays. The Hubble program completed design, manufacture, checkout, and 
implementation of a huge IR lamp array accompanied with thorough documentation. The knowledge 
and documentation resulting from Hubble’s experience should have direct application to any new 
spacecraft system-level testing. 

The Hubble program completed a rigorous evaluation to specify thermal stability criteria for 
each test phase of TVT. After lengthy debates, the thermal group successfully obtained agreement to 
conduct certain thermal balance test segments without interference from electrical reconfiguration of 
power level changes. These tests were critical to the follow-on correlation to math models. The stability 
criteria established had to be met before configuration to the next test segment was initiated. This 
experience indicates that thermal balance tests should be a requirement for thermal control system 
verification. This experience should also serve as a shortcut for future programs in specifying and 
justifying criteria. 

During TVT development testing for Hubble’s SSE TCS, multilayer insulation (MLI) blanket 
performance did not meet expectations, which were based on previous testing of the other Hubble 
hardware. It was discovered that the outer layer material of aluminized Teflon™, combined with the 
absence of a netting spacer, is not suitable for the blanket design of small components. The CTE 
differences between the aluminized layer and the Teflon™ substrata caused the outer layer to shrink at 
cold temperatures. This shrinkage would compress the blanket at the comers, creating thermal shorts and 
reducing performance. This prompted a more thorough evaluation test to determine relative MLI blanket 
performance for small components. As a result, the final blanket design for the Hubble’s SSE TCS used 
Tedlar™ as the outer layer, and Dacron™ netting as the sublayer spacer, which gave much better 
performance for such small MLI designs. 

During Hubble’s thermal vacuum test, several failures of the thermal control system occurred. 
Posttest evaluation eventually traced the failures to faulty thermostats. The failures were specifically 
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attributed to improper dry gas backfill by the manufacturer. A plan was developed to replace all 
potentially affected thermostats. This plan included installation steps to revivify heater circuitry after 
replacement. This particular step was especially important in the absence of further environmental 
testing. Accurate documentation of this step is very important for future reference. 

e. Summary . The Hubble project taught many valuable lessons that have been briefly described 
in the above paragraphs. Hubble was planned for orbital verification and mission support. Much effort 
was expended to have all technical experts trained, and to have ground-based simulation of the on-orbit 
spacecraft, etc., put in place for resolution of slight anomalies. One problem occurred during the initial 
orbiting and checkout phase — the determination of the spacecraft orientation. Eventually, an abbreviated 
method was developed to determine spacecraft orientation from telemetry data. Future spacecraft 
training sessions must have a system approach so that this type procedure would not have to be worked 
out in real-time. 

Despite the various problems discussed here and the ones illustrated in the appendix, Hubble was 
a very innovative and specialized design, as the current science being collected proves. The ability to 
make telemetry software changes was a lifesaver and is a standard approach, but must be well thought 
and designed for. The same is true for the maintenance mission, which required not only the design for 
line replaceable units but consideration of the labor complexity involved for on-orbit repair in zero g and 
by astronauts in space suits. The success of the original mission phase, the repair mission, and the 
ongoing science mission after the repair gives evidence of design and program success. Figure 121 
shows the repaired Hubble being deployed from the shuttle. 


H. Spacelab 

1. Characteristics . The Spacelab system was designed by the ESA to provide a flexible orbiting 
laboratory within the shuttle cargo bay for conducting various experiments and research in space. 69 It 
consists of different combinations of enclosed human working areas called modules (two lengths) and 
open V-shaped pallets, which expose experiments to space or act as launching/retrieval platforms that 
are exposed to open space when the shuttle cargo doors are open. The modules have a life support 
system, experiment racks with power, etc., with space in between for the astronauts to work. Figure 122 
shows a basic module and figure 123 depicts a typical pallet. Figure 124 shows some of the basic 
combinations of modules and racks in the cargo bay. In the modules, the astronauts/scientists have 
essentially a lab to work in as they do on Earth. The pallet experiments can be controlled from the 
module or the orbiter crew observation deck. 

Spacelab missions are cooperative efforts between scientists and engineers from around the 
world. Teams from NASA Centers, universities, private industry. Government agencies, and 
international space organizations design the experiments. Some scientists actually fly and run the 
experiments in space, with support from scientists and engineers on the ground who work and 
communicate with those on-orbit via voice, video, and data links. The reusable international vehicle 
allows them to bring the experiment samples back to Earth for further study. 

Many missions have flown using Spacelab hardware in various combinations. The experiments 
covered the gamut from microgravity to stellar observation. For example, Spacelab flew on STS-9 in 
1983, with 73 experiments. The laboratory module flew again on STS-51B, as Spacelab 3, emphasizing 
low-gravity materials processing. Spacelab 2, on STS-51F, was a pallet-only mission, studying solar 
science. Spacelab D-l, on STS-61 A, was a German mission. 

Spacelab became more specialized in the 1990’s. Astro missions were dedicated to ultraviolet 
and x-ray astronomy. This included Atmospheric Laboratory for Application and Science (ATLAS), 
Spacelab Life Sciences (SLY), United States Microgravity Laboratory (USML), United States 
Microgravity Payload (USMP), International Microgravity Laboratory (IML), Spacelab J (Japanese 
Materials Processing), and Spacelab D-2 (a German reflight with upgraded experiments). 
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Figure 121. HST deployment after fix. 
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Figure 122. Spacelab module configuration. 






Figure 122. Spacelab module configuration (continued). 
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Spacelab, as a laboratory, has emphasized microgravity science, life sciences, astrophysics, solar 
science, space plasma physics, and atmospheric science. It has proved to be a very valuable workhorse, 
extending the shuttle to be an effective short-term laboratory, and has established an excellent technical 
base for the upcoming International Space Station . 

2. Evolution/Creativitv/Evolution . The basic idea of a combination of working quarters in space 
(modules), in combination with the V-shaped pallets, was very creative. The modules themselves, with 
the various type racks, gave much flexibility in terms of experiments and laboratory setups. Obviously a 
laboratory must have the capability of heat and cold, vibration, etc. All the materials and equipment 
must be compacted, stored, and fastened down to survive the launch, reentry, and landing environments, 
which was no small feat within itself. Delicate observation instruments had to have the same stowed 
requirements, yet, while in space, they had to be very flexible for pointing control, etc., and to some 
extent be isolated from the shuttle on-orbit motions. 

3. Problems . One problem area for Spacelab was the design and verification of the module racks. 
There have been two basic problems, the first being the load paths and load carrying capability. The 
other, the rack natural frequency. 

Load carrying capability is best exemplified by the high stress levels that occur for the mission 
peculiar equipment (MPE)-to-drop physics module (DPM) mechanical assembly interfaces, MPE-to- 
Spacelab rack interfaces, and DPM microgravity measurement assembly (MMA)-to-Spacelab rack 
interfaces. The cause of the high stress levels was due to the stiffness and large mass of the DPM in the 
lower portion of rack 8, especially the MMA. The problem has been solved by maintaining minimum 
“close fit” interfaces between MPE, DPM, and the Spacelab rack, using match and drill for MMA and 
epoxy in selected slotted holes in the rack. 

In order to ensure that Spacelab equipment and experiments do not tune dynamically with the 
shuttle dynamics during lift-off and landing, a lower frequency constraint of 25 Hz was placed on major 
elements, such as racks, and 35 Hz on secondary elements, such as experiments attached to the racks. 
The racks had trouble meeting their frequency constraint, both analytically and through dynamic 
verification testing. There were two solution options: (1) redesign the racks to accept the larger loads 
introduced by the dynamic tuning, and (2) redesign the racks to meet the frequency constraints. The later 
approach was taken, with minimum design fixes. 

A few of the other Spacelab problems are listed in the matrix. 

I. International Space Station 

The design of a long-life space station must deal with several demanding requirements. First, it 
must be able to withstand the launch environments, which have a different demand than on orbit. 
Second, since it is not possible to launch the totally assembled station at one time, the station must be 
designed for on-orbit assembly. Third, the station is to be human-tended, requiring a life support system 
that has minimum refurbishment and logistic requirements. Fourth, the station must be designed to 
withstand harsh on-orbit environments such as debris impacts, thermal variations, etc., with minimum 
refurbishment. Fifth, power must be obtained from the Sun, which requires solar cells, batteries, etc., 
needing minimal attention. Sixth, it must be a scientific laboratory, with all that implies. Seventh, means 
of docking and undocking spacecraft, such as the shuttle, must be accommodated with means of trans- 
ferring crew and supplies, as well as having a crew return vehicle in case problems occur. Also, some 
experiments can be deployed and retrieved. Eighth, cost is a big driver and must be a major criterion in 
the design and operations. Finally, it can be a wayfaring station for missions to the Moon and planets. 

As a result of these complex requirements, the space station configuration has gone through 
many evolutions in order to cut cost and better align with the national budget constraints. During this 
process, not only has the configuration changed greatly, but it has become truly an International Space 
Station ( ISS ) with hardware being provided by Russia, Japan, Canada, and ESA (fig. 125). The impacts 
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Figure 125. ISS. 


of these changes have affected not just the station, but have changed how science and operations are 
achieved, as well as the impacts to the space shuttle hardware required in order to place the desired 
components into the proper orbit. (These changes were discussed partially under the section on the 
SLWT.) As a result; the present configuration is now frozen and in final design, with hardware being 
manufactured. This configuration meets all the basic requirements and is well on the way to operational 
capability. 

1. Characteristics . There are many crucial subsystems to a long-term orbiting station. They 
include, but are not limited to: (1) life support, (2) power, (3) propulsion, (4) control, (5) science labora- 
tories, (6) docking adapters, (7) structural systems, (8) meteoroid debris protection systems, and (9) crew 
quarters. Most of these have many subsystems or elements themselves with specialized functions to per- 
form. All these subsystems work together as the ISS. 

The environmental control and life support system (ECLSS) is composed of several subsystems 
(fig. 126). The ECLSS functions and subfunctions are shown on figure 127, and include atmosphere 
revitalization, atmosphere control and supply, temperature and humidity control, water recovery and 
management, waste management, fire detection and suppression, and other functions such as food 
storage and preparation, radiation protection, etc. The goal of ECLSS is to provide a healthy, 
supportable environment in which astronauts can live and work efficiently without costly use and loss 
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Atmosphere Revitalization 
-CO 2 Removal 
-CO 2 Reduction 

- O2 Generation /Supply 

- Trace Contaminant Monitoring 

and Control 

- Microorganism Control 


Atmosphere Control and Supply 

- Monitoring Major Constituents 

- Atmosphere Composition Control 

- Atmosphere Constituents Storage 

- Pressure Control 


Temperature and Humidity Control 

- Temperature Control 

- Humidity Control 

- Ventilation 

- Equipment Cooling 



Figure 126. ISS ECLSS. 



Figure 127. ISS ECLSS function. 








(replace) as the current systems used on shuttle do. Instead of carrying enough oxygen, water, etc., for 
the mission, the system recycles, as much as is economically feasible, comparable to the Earth’s system. 
Figure 128 is the basic ISS showing the ECLSS components. The U.S. laboratory module is shown of 
figure 129. This module will serve as the main control to support the subsequent assembly flights. It 
includes internal audio system, video system, and internal control and life support systems. 

Another very critical subsystem is the meteoroid debris protection system. This system is 
designed to mitigate debris damage to the station, potential loss of human life, and loss of critical func- 
tions and science. The approach deals with the debris environment determination/impacts, impact 
damage, and loss due to damage (fig. 130). The external protection system is built up of layers of 
shields/bumpers as shown on figure 131. 

Solar arrays provide the energy for the power system, as was shown on figure 125. The system 
receives the Sun rays, converts it to electrical power, and stores the excess in the batteries. The structural 
system is composed of the central truss around which the other elements such as the modules are 
attached. There are docking modules for the space shuttle and Russian spacecraft and the abort crew 
recovery system. Figure 125 shows many of these systems as well as the country providing the 
hardware. 

The space station is a very complicated system. It is not the purpose of this report to discuss all 
these characteristics. It must be assembled in space using several launches spread out over a year or two. 
To utilize the Russian launch capabilities, a 51° orbit inclination led to the shuttle performance 
enhancements that included the development of the lighter weight external tank. At the time of this 
writing, all were being accomplished as planned. 

2. Evolution/Innoyation/Creativitv . There are so many innovations that have occurred to date in 
the development of ISS, it is not possible to discuss them all. Obviously, since ISS is still in develop- 
ment, many others will evolve. 

The meteoroid protection system mentioned previously is truly a creative design. Not only does 
it protect against impact damage, but it also deals with equipment location to minimize damage, crew 
escape procedures, etc. Not only has the design been very creative, but it also has the analysis and 
testing approach. The testing of impact damage determining hole size, leak resistance (rate), etc., for 
many different protection approaches was completed. For example, figures 132 and 133 show the test 
setup for measuring depressurization of a module. 

Development of the life support system has many innovations in its design. These systems are 
very complex, composed of chemical, fluid, electrical, hydraulic, control, etc., all linked together in a 
highly interactive system. To develop and verify ECLSS, long-term hardware tests have taken place 
from a module loop down to a water recovery system test. This innovative breadboarding has allowed 
problems to be made visible and the design to be corrected. 

The management approach between Government and industry has also been very innovative. 
There is one prime contractor — Boeing. Integrated product teams are used for design and development. 
These teams have Government support, with membership and engineering tasks from analysis, to 
simulation, to testing. Integrating into the ISS , hardware from the international partners has challenged 
the best in innovative management. To date, all is working well, hardware is built, other hardware is 
proceeding, operational procedures are under way, as well as the on-orbit assembly techniques, etc. 
Problems have occurred and will continue. The team in place should handle them well. 
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Figure 128. ISS with ECLSS subsystems. 



U.S. Laboratory Module 
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Figure 129. ISS U.S. laboratory module. 



Orbital Debris Risk Mitigation 
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ENHANCED MANNED MODULE ORBITAL DEBRIS SHIELD 
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Figure 131. ISS debris protection configuration. 


Manned ‘Module Internal Effects Following A Penetration 
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Figure 132. Meteoroid debris testing approach. 







Module Through-Wall Hole Depressurization Tests 
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Figure 133. Debris impact results of pressurized container. 


3. Problems . Although many problems have occurred so far in ISS development, only a few 
typical ones will be highlighted. As was experienced on the Spacelab project, the racks did not meet the 
25-Hz frequency constraint due to its open box construction for crew utilization. The problem was 
solved by adding stiffening to the rear of the rack and making the utility panel a structural element 
instead of a closeout, which raised the frequency without compromising the crew access. 

The meteoroid debris protection system design was discussed in section 2 and requires no further 
discussion. The glass window design for the modules experienced fatigue cracking when the sustained 
stress due to on-orbit delta pressure was applied. The problem was aggravated by the moisture content 
of the ambient air, causing stress corrosion effects in the glasses’ microcracks when under stress. 
Several things were accomplished to solve this problem: (1) conservative fracture mechanics method- 
ology was employed for the window redesign; (2) proof testing of each pane of glass was required to 
screen initial flaws larger than those acceptable by the fracture analysis; (3) windows were redesigned 
such that tension is not on the inside surface of the pane, making it damage tolerant; and (4) the cavity 
between the primary and redundant pressure panes was vented to space to reduce exposure to moisture. 

The development of the life support system has had several problems. These developmental 
problems have utilized long-term ground demonstration testing of the various subsystems. As a result, 
the hardware has experienced many development problems. For example, the testing of the Hab/Lab 
element resulted in cyclic variations in cabin temperature, carbon dioxide (CO 2 ) partial pressure, and 
dew point. It was found that the CO 2 removal subsystem was returning air exhausted into the cabin. The 
solution was to reroute the CO 2 removal subsystem exhaust to upstream of the condensing heat 
exchanger. Another problem had to do with the overall system complexity and component redundancy, 
which utilized separate loops for potable and hygiene water reclamation. The solution was to combine 
the two loops into a single water reclamation loop. The water system in another problem was not 
completely sterile prior to testing. This was caused by microbial growth in the test system particularly in 
plumbing dead legs. The solution was to eliminate the plumbing dead legs and sterilize the system with 
hot water at 250 °F. Water was also entrained upstream of the CO 2 removal subsystem. This was caused 
by a break down of the silica gel when subjected to liquid water. The CO 2 removal subsystem was 
modified by adding a layer of Zeolite 13x™ upstream of the silica gel, solving the problem. See the 
matrix for other problems. 


J. Titan Viking 

The Titan launch vehicle has been a workhorse not only for Air Force payloads, but also for 
many NASA payloads. The author worked the Titan Viking program from the launch vehicle standpoint, 
which dealt with three launches: Viking simulator, German Helosis, and Viking, mainly from the 
standpoint of a first stage pogo concem/problem. The pogo concern, and thus the pogo working group, 
was active for approximately 2 years part-time. Jet Propulsion Laboratory (JPL), LaRC, MSFC, and 
Lewis Research Center (LeRC) were the NASA Centers involved with the Martin Aerospace 
Corporation. 

The vehicle had not only the boost stage with solid strapons, but also an upper stage called 
Centaur. The basic problem that Viking faced had to do with a known pogo oscillation that occurred 
near the end of the liquid boost stage bum. When the Titan Viking simulator test was flown, this pogo 
oscillation was of family, creating loads on the spacecraft that were larger than the design loads. Since 
the basic spacecraft was already designed, this was a major problem. Either the spacecraft had to be 
beefed up structurally or the pogo problem eliminated. As a result, a blue ribbon team was formed to 
understand and recommend actions in terms of the problem. The team stayed active until just prior to the 
Viking launch. The preliminary assessment showed a dynamic tuning of the Viking simulator with the 
vehicle longitudinal bending mode, reducing the equivalent damping or, said differently, increasing the 
modal gain in the pogo loop. At that time, it was rationalized that the real Viking would be different; 
therefore, the program proceeded. 
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The next Titan launch was the German Helosis payload and was comparable in size to Viking. 
Since Helosis had no loads problem, it was deemed acceptable to launch the system. The result of the 
launch was successful; however, the pogo response was larger than for the Viking simulator. The team, 
along with contractors, spent a lot of time studying the data, running sensitivity pogo and loads studies, 
and conducting special tests. It was found that the vehicle had stood on the pad for 2 days in a cold 
wind, which shifted the gain in the propulsion system, changing the pogo response. 

When this was understood, it was decided to put an accumulator on the propellant duct, detuning 
the structural system from the propulsion system, thus eliminating the pogo oscillation. Parallel to this 
fix design, structural dynamic tests were run on the Viking payload in order to help verify the margins of 
the Viking system. The pogo fix was designed and installed without impacting the launch date. The 
flight was successful. No pogo occurred, thus there were no load increases to impact the Viking payload. 
History shows the final success of the Viking probe. 

The message of this activity is very clear. When large energy sources (thrust) are present, 
coupling dynamically with other systems (structural, fluids, and acoustical), the response is generally 
nonlinear and is, therefore, very sensitive to small variations. The small shift in dynamics (Viking 
simulator) from prior systems and the longer pad time in low temperatures (Helosis) are examples of 
how small changes and the nonlinearities can create large unwanted responses. When these conditions 
are present, it is always prudent to eliminate the coupling and make the system robust. This was done for 
Titan Viking, resulting in a successful program. 


K. Experiments 


NASA and Marshall have flown many experiments, in particular on the space shuttle, mainly 
using various parts of the Spacelab discussed previously. These experiments have many times been joint 
ventures with other countries such as Italy, Japan, ESA, Canada, etc., where the system was built by the 
International partners, flown by the U.S., and a joint experiment conducted. Others were totally U.S. 
experiments. The following is a partial list of these experiments. 


Experiment 

Purpose 

Supporters 

IPS 

To develop a common pointing mount for flying 
observatories in the space shuttle. 

ESA/U.S. 

SAFE/DAE 

To qualify a lightweight solar array with fold/unfold 
capability and demonstrate on-orbit dynamic test 
capability using remote sensing. 

U.S. 

Astro 

To give astronomers a view of the universe 
impossible to obtain from the ground. 

U.S. 


1. Safe Solar Arrav/Dynamic Augmentation Experiment ISAFE/DAEf In September 1984, 
NASA tested the SAFE/DAE on shuttle mission STS-41D. This testing qualified advanced solar arrays 
and large space structures technologies that have several features which had marked improvements over 
what was being used at that time. 


The solar array was approximately 100-ft long (30.9-m) and 13.1-ft (4.0-m) wide. The total 
experiment, including the array, totaled 940 lb in weight. The array was a flat-fold flexible substrate 
solar array sized to output more than 12.5 kW at the base of the wing at 55° centigrade normal to the Sun 
in near-Earth space. The array blanket consisted of 84 panels, 0.37 by 4 m (14.5 in by 13.1 ft ) in size, 
that were mechanically hinged together to allow easy replacement of the panels. Only two of the panels 
had active solar cells for the experiment. The other cells used glass sized simulators in order to reduce 
experiment cost (fig. 134). The wing was deployed and retracted using an AEC-ABLE Engineering 
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Figure 134. Solar array deployed. 


Company mast that retracted into a canister (fig. 135). The solar array mast combination was attached to 
a Spacelab pallet in the shuttle cargo bay. The array/mast was deployed and retracted four times during 
the mission’s 23 1 /2 h of experiment time. 

Dynamically testing a large space structure in orbit is highly desirable since such a large 
lightweight structure cannot be tested on ground in the gravity environment. Two approaches were used 
to acquire the dynamic data when the system was excited using the orbiter’s vernier control reaction 
system (VCRS) jets. The two approaches were: (1) Photogrammetry using shuttle cameras to record the 
dynamic motion of the structure. Sixty-three white circles, approximately 16.5 cm (6.5 in) in diameter, 
were located at regular intervals on the front of the blanket. Another 63 were located on the back side of 
the blanket. These data, collected during and after the VCRS firings, were evaluated using special data 
reduction techniques to produce mode shapes and frequencies. LaRC developed the photogrammetry 
approach. (2) Dynamic augmentation experiment (DAE). The DAE is an adaptation of a multifield star 
tracker that was designed to determine the dynamic characteristics during the above discussed tests. A 
retroreflector field tracker (RFT) positioned near the base of the solar array wing used laser diodes to 
illuminate 23 targets on the array. A second microprocessor computed the dynamic displacement from 
the line of sight, feeding the results to an onboard recorder. The data were ground processed, determin- 
ing mode shapes and frequencies. 
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Figure 135. Solar array deployment mechanism. 

The results of the dynamic experiment were very good. One anomaly occurred when the array 
went from day to night, causing curling of the array coupling pitch and yaw, and slightly shifting the 
frequencies. Therefore, the frequencies of the deployed array were consistently higher in darkness than 
daylight. Postflight analysis verified this effect. Overall, the predictions (after this modification) of fre- 
quency, mode shapes, and deflection amplitudes matched quite well. 

Damping was consistently higher for in-plane motion than for out-of-plane motion. Lockheed 
performed tests showing that if the tension wire reel-out force was greater than the reel-in force by as 
little as 1 lb, then the entire kinetic energy would be dissipated in one-half cycle in the free-motion 
period. Testing found that the actual reel-out versus reel-in was about 0.65 lb. 

The SAFE/DAE demonstrated that lightweight solar arrays, with reel-out/reel-in capability 
works very well. Power generation predictions were also verified. A first step in on-orbit dynamic test- 
ing of large space structures was demonstrated using two separate approaches. Both worked ade- 
quately. 70 71 

2. Tethers in Space 

a. Characteristics . Tethers can be used for many applications in space, a few of which are: 

(1) Electrodynamics power generation (electrodynamics brake) 

(2) Electrodynamics thrust generation 

(3) Multiprobe for atmospheric studies 

(4) Rotating controlled-gravity laboratory (tethered platform) 

(5) Tethered satellite for cosmic dust collection 

(6) Tethered docking 
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(7) Science applications tethered platform 

(8) Waste disposal. 

The first tethered satellite, called TSS-1, was built and flown to demonstrate the capability to 
deploy, perform science, and recover a tethered system. Two additional small-mass tethered systems, the 
Small Expendable Deployer Systems (SEDS), have been launched successfully from unmanned 
launched payloads. (These SEDS missions will not be discussed further in this report.) TSS-1 had a 
major problem with the level wind mechanism and did not fully deploy (discussed below). As a result, it 
was reflown in March 1996. 

The TSS-1 system was composed of a spherical-shaped satellite, containing numerous scientific 
instruments, antennas, the reaction jet control system with appropriate sensors, and the tether attach 
mechanism. 72 The satellite weighed approximately 520 kg. The basic features are shown in figure 136. 
The attitude control system is composed of four rate-integrating gyros with feedback, horizon scanner 
(Earth scanner), accelerometers and magnetometers, and thrusters (reaction jets) in the positions needed 
for attitude control, science, and tether deployment. There are eight thrusters groups. Four nozzles are 
in-plane (pitch), four are yaw, two are out of plane (roll), and four are in-line. The tether tension during 
operations is maintained by gravity, centrifugal force, and in-plane thrust. 

The tether used for deployment, retrieval, and as a conductor was 20-km (12-mi) long. It had a 
core of Nomex™, the copper conductor, covered by a 0.012-in thick insolation and wound with 10 
strands of Kevlar™, then braided on the outside with Nomex™. It had a diameter of 2.54 mm (0.1 in) 
and a mass of approximately 8.2 kg/km. 

The support and deployer mechanism are shown in figure 137, including the docking and support 
ring, while figures 138 and 139 show the system in the cargo bay with the boom partially deployed. 
Figure 140 shows the tether control mechanism, while figure 141 is a sketch of the tether level wind. 
The system was composed of the tether control deploy and take-up mechanism, the satellite support 
structure, the extendable/retractable boom, the canister, etc., which served three functions: (1) provided 
a means of transportation in the orbiter (launch and landing); (2) served as an operational base for the 
deployer and, through the pallet, as an interface with the orbiter; and (3) deployed and retrieved the 
satellite. In the mission scenario, the total mission time was approximately 30 h. Deployment took the 
first 5.3 h, which was to be followed by 10.5 h of science time at the 20-km (12-mi) tether length. The 
first leg of retrieval took 6.75 h, followed by 5.0 h of science. During this time, an orbiter yaw maneuver 
can be conducted to dampen skiprope dynamics, if present and of a large enough magnitude. Final 
retrieval was to have taken 1.9 h and contain a period of satellite attitude control to dampen the 
remaining skiprope (fig. 142). 

b. Evolution/Creativitv/Innovation . The basic idea of a tethered system itself is very innovative, 
especially in light of potential applications mentioned earlier, and others not mentioned. The basic 
physics of the problem of using tethered systems centers around the conservation of momentum of the 
orbit. In this case, the orbiter and the satellite are a system in a specific orbit at a certain energy level, 
which must be held constant. The tether keeps the two bodies, though separated, operating as one 
orbiting system with the energy level of the system before the tethered satellite was deployed. A 
deployment force (thrusters) moves the satellite out from where the two end masses were initially in the 
same orbit. The gravity gradient force is proportional to the separation distance. After a certain distance 
from the orbiter, the combination of gravity gradient and centrifugal forces are sufficient to overcome 
system losses (friction) and continue the separation. Because the two masses are constrained by the 
tether, the upper mass gains a higher kinetic energy per unit mass than the lower mass. The tether 
constraint causes the orbiter and satellite to have the same angular velocity. During deployment, the 
lower mass will drag the upper mass until libration occurs. This results in momentum transfer through 
the tether from the upper to lower mass as tension. The off-vehicle attitude is caused by the Coriolis 
term of the acceleration expression creating libration of the system as the tether length is changed (fig. 
143). The Coriolis force is perpendicular to the Earth’s radius for radial deployment/retrieval. 
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Figure 136. TSS-1. 
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Figure 137. TSS-1 deployer mechanism. 



Figure 138. TSS-1 in cargo bay partially deployed. 
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TSS Satellite Deployment Scenario 


Typical Electrodynamics Mission Scenario 

• Orbiter Attains Approximately Circular 
296-km (160-nmi) Orbit 

• Unlatch Satellite and Deploy Outward 
Using the 12-m Deployment Boom 

• Release Satellite and Control Upward 
Trajectory Using Tether Reel Motor to 20- 
km Deployment 

• Control Satellite on Station 

• Retrieve Satellite, Stop at 2.4 km, 
Complete Retrieval, Dock to Boom Tip, 
Retract Boom, and Latch Down Satellite 


S-Band Communications & K u -Band 



Figure 139. TSS-1 in cargo bay partially deployed. 



Figure 140. TSS-1 tether control mechanism. 
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Figure 141. TSS-1 tether level wind. 



Notes: 

This Damps Skiprope 


Figure 142. TSS-1 mission profile. 
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Dominant 



Tethered Deployment 

Figure 143. Tether deployment forces. 

As the deployed system moves around the orbit with the new center of gravity located on the 
original orbit, it cuts through the low density atmosphere and the Earth’s magnetic field. The 
aerodynamic drag deflects the tether, as do Earth’s magnetic fields (fig. 144). Cutting through Earth’s 
magnetic field causes a current flow, the direction of which can make it a generator or a thruster. Notice 
also that the two bodies are now in different orbits, thus cutting the tether has an orbit change effect. 
Obviously, many possibilities exist then for the use of tethers. It can be deployed earthward and used as 
a sensor in the atmosphere. Sent outward, it can do science. The reader can explore these and many 
more ideas in reference 73. There were many ingenious ideas used for TSS-1. Since most were used to 
solve problems of the mechanism or of the system interaction with the environment, they will be 
discussed in the next section on problems. 

3. Problems 

a. Dynamics . As discussed above, the orbiter-tether-satellite system interacts dynamically and 
with the environment, setting up several modes of dynamic oscillation. These modes are shown as if the 
orbiter was fixed, which is a fair assumption due to the relative differences in mass of the orbiter and 
satellite (fig. 145). The libration mode can be damped by changing the tether tension with the correct 
phasing with the motion. The pendulous mode can be damped with the satellite attitude control, if 
needed. The major problem is the tether string mode governed by the tether length and tension. This 
mode can be set up by the aerodynamic or electromagnetic forces, the greatest being the electro- 
magnetic. As the tether is pulled in during deployment, due to energy conservation and the tether length 
changes, the amplitude and frequency increase. As the length shortens to around 600 m, the string mode 
and the satellite spin mode get in resonance, causing large satellite angular excursions. The results are 
either the inability to dock the satellite due to the misalignment or the loss of tether tension, hence, 
control. The basic problem is how to damp the tether skiprope so that there is not much energy avail- 
able for resonating with the satellite spin motion. This skiprope management problem is 
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Although as illustrated the tether forces are in-plane this is 
not the general case and excitation usually occurs in both planes. 

Figure 144. Electrodynamic tether properties. 
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Figure 145. Dynamic modes of a tethered satellite. 



complicated by the difficulty of sensing the amplitude, phase, and frequency of the skiprope dynamics. 
It can be inferred by the dynamics it introduces into the satellite, by visual observations from the orbiter! 
or by some other end effector sensor. It was decided to the use the telemetered satellite control system 
data (rate gyros output) as the data source to infer the skiprope dynamics. Two ground operations data 
processing schemes were developed to determine the tether skiprope state. The first was essentially a 
Kalman filter that worked in the time domain. The second was a frequency domain scheme. Both pro- 
duced accurate predictions and were used during the TSS-1 mission. The time domain filter was pri- 
mary, with the frequency domain as backup. Numerous computer simulations were run with known 
skiprope conditions to verify the approaches. With this ability to determine the skiprope characteristics 
in real-time, the ability to deal with the skiprope problem was available. 

The solution to the problem was then a multifaceted approach for containment of skiprope, pro- 
ducing successful satellite recovery, and the elimination of safety concerns involving the orbiter and 
crew. The basis of the approach was to determine how much skiprope amplitude could be handled from 
600 m and provide a means of damping skiprope below this level prior to entering this period of satellite 
retrial. The elements of this approach were: (1) observing the skiprope amplitude and phase using 
satellite information (rate gyro telemetry data) as discussed above, (2) orbiter yaw maneuver during the 
second period of science at the 2.4-km distance based on the observed data to reduce the skiprope 
amplitude below 20 m (the amplitude that could be handled during reel in from 2.4 km), 
(3) attitude control of the satellite during the resonance period discussed above, and (4) use of a passive 
tether damper to suppress the skiprope as the satellite gets close to the orbiter. 

The passive damper was an innovation within itself. Figure 146 shows the damper installed in 
the docking ring. It consists of a yoke and ring through which the tether is passed from the reel below 
and three small negator motors located 120° apart on the docking ring attached with cables to the 
yoke/ring; thus, as the tether moves, the yoke/ring moves the cables and the negator motors provide 
damping to the skiprope. The design trick was how to get enough damping without getting so much that 
the yoke/ring forced a new end point for the tether, therefore, providing no damping. Through much 
testing, including testing in a thermal vacuum chamber, this design goal was achieved. 
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Figure 146. TSS-1 tethered satellite passive damper configuration. 
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Actual flight of TSS- 1 showed conclusively that the multifaceted approach worked with little or 
no skiprope and successful satellite docking. 

b. Tether Hang-Up . TSS-1 was not successful due to tether reel hang-up at 256 m of deploy- 
ment. Many attempts were made to free the system and deploy the tether, but none were successful and 
the satellite was retrieved and returned to Earth for assessment and a later reflight. 

Tether hang-up was caused by the installation of a larger bolt on the reel attachment to the pallet 
in order to eliminate a negative structural margin of safety for the shuttle lift-off loads. The larger, 
longer bolt protruded into the path of the level wind mechanism, catching it and locking it up in the 
deploy direction precluding further deployment. A simple change, not verified for its system effects, 
caused the loss of a potentially outstanding mission. The message is clear: changes must be verified for 
their effects. 

Other problems occurred during development, but they centered around the typical problems of 
the development of mechanism and normal hardware and electrical fit problems. The development of 
mechanisms of deployment provided the greatest challenge. The deployable/retrieval truss technology 
was well developed by the time of TSS-1 and proved to be no real challenge. 


L. National Launch System/Space Transportation Main Engine (NLS/STME) 

Although the NLS/STME program was canceled, it was an early attempt to work a program 
using Government/industry product development teams and other changes in the contractor’s 
relationship with the Government. The program was, in reality, a joint NASA and Air Force venture 
where NASA was the basic program manager for the engine. All this restructuring was taking place at 
the time of the peak of the Deming movement on quality in the United States and was influential in the 
approaches used for this program. 

Initially, the program had a major concern over the NASA-leveled criteria and requirements. In 
order to deal with this issue, the first thrust was focused on the STME. The STME was to be developed 
by a contractor consortium composed of Rocketdyne, Pratt & Whitney, and Aerojet, with oversight by 
MSFC, using a chief engineer and a project or program chief. The contractor-led group was located in 
Huntsville, near MSFC, with the basic work accomplished at each of the contractor’s plants. The con- 
tractors not only had the management of the total system at Huntsville, but had a manager at each plant. 
In order to efficiently design and build an engine in this manner, the engine was divided by components 
and assigned to the individual contractor’s plants. Since the basic criteria and requirements came from 
Marshall’s Science and Engineering Directorate, it was decided to form a team composed of the con- 
tractors’ leads and the deputy directors of Marshall’s Science and Engineering Directorate. The team 
was led by NASA. The team started the process by visiting each contractor’s plant and discussing the 
program philosophy and the impacts of the current NASA criteria, etc., on program cost, etc. As the 
team progressed in this activity, it became clear that the requirements and criteria, to some extent, 
depended upon the management approach chosen by both Government and industry. The team spent a 
major effort in setting up this approach. 

The basic philosophy chosen was the institution of joint Govemment/industry product design 
teams basically chosen for each engine component, plus an engine system and engine team. The teams 
were to be pure design and manufacturing teams responsible for the product, including cost and 
schedule. There was to be no distinction between the Government and contractor members, where each 
worked their various tasks and together decided key issues. A steering committee was set up to guide the 
program and resolve issues, and the program proceeded. 

With this approach in place, the team could move into working requirements and criteria. Having 
Government specialists as working members of the PDT’s allowed sustainable reductions in 
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documentation requirements (150 reports reduced to approximately 20). The criteria were worked 
separately using specialist teams of Govemment/contractor members. The guidelines given to the teams 
were that the criteria contain no “how to’s” and be restricted to critical mandatory criteria to ensure 
safety. The criteria were not to determine the design solution, freeing the design teams to do good 
engineering without undue constraints. Criteria were reduced by approximately 80 percent. 

At the time of program cancellation, the teams were working and some development hardware 
was manufactured. Although this first approach was not perfect, it set a precedence that later programs 
have improved upon. 


TV. CONCLUSIONS 


Capturing what studying problems and experiences have revealed into a summary is very diffi- 
cult; therefore, it is with some trepidation and risk that this necessary task is accomplished. Conclusions 
are in the eyes of the beholder. Each should feel free to draw their own conclusions from the text. In 
general terms, each separate set is valid and should be attempted. Woven into this fabric of “lessons 
learned” is the naturally evolving formation and interaction of the design, analysis, and science groups 
in a maturing technical organization. Central to the development of a product is the creative design 
engineer, whose primary function is consumed with the work ideas and who is focused on the advanced 
product, and its performance and reliability in all the interacting disciplines and the robust system. 

Most of the time, the product performs well as designed, and sometimes it works adequately for 
the wrong assumptions and phenomena, usually under less sensitive or demanding environments. How- 
ever, where the appropriate emerging environments trigger the unsuspected phenomena that lead to 
failure ( Challenger SRM O-ring, SRB ignition overpressure, SRB aft skirt failure, etc.), experts are 
drawn from the scientific staff and institutions to complement the design core analysts groups to resolve 
the problems and establish another lesson learned. 

What this implies is that a different mind set and skills are required for the different jobs in the 
process, from science to design to problem solving. Universities have moved away from this under- 
standing and now depend too much on the computer/analysis without putting the students into the real 
world in order to develop the intuition required for design and problem solution. Students need to have 
experience with hardware failures. Ferguson, in “Engineering and the Mind’s Eye,” an MIT publication, 
has an excellent discussion on this viewpoint. 

The author challenges each reader to compile their own valid set, corollaries, and derivatives. 

1. Engineering has evolved from an overall system design performed by a chief designer in 
general at a drafting table to a design of specialization using large computers and work 
stations. This is accomplished through compartmentalization, first into subsystems, elements, 
and components. Then, each of these is separated out by disciplines. As each task by 
discipline is accomplished, it is integrated into the component, then the element, the sub- 
system, and finally the system (fig. 147). Looking at this evolved process, several lessons are 
obvious: 

a. The integrity of the product is in the system, since nothing exists in isolation and only per- 
forms in the system as a system. “Now whenever a change is made, by the passage of 
energy, and a result is left, it takes place in a group of things,” David Pye. 

b. The lack of a system focus is the main cause of loss of product integrity (problems) and is 
not the result of missing technology. 
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Figure 147. Design process. 

c. The need is for the indepth specialist, with a system focus/viewpoint, to parallel with a 
sound approach to systems integration that starts with analysis and test and ends with 
hardware. The paradox faced is: how do you maintain the specialization yet be a generalist 
and have a system focus? 

d. The large volume of data/information generated requires the collapsing of the data into 
general physical symbols so that understanding is ensured. Corollary computer simulations 
must have the ability to go from wide angle (general) to telescopic (details) when required. 
Example: general stress field versus stress concentration at a weld or flaw. 

e. Metrics for the system design must be established that include cost, performance, opera- 
tions, manufacturability, and reliability. 

f. Design is a balancing act between conflicting requirements. You must take some of what 
you do not want to achieve approximately what you want — always a trade that involves 
risk, complexity, cost, performance, and verification. 

g. Senge’s fifth discipline 6 emphasizes the learning organization and the importance of sys- 
tems, two very important parts of any successful organization and product development. In 
other words, nothing operates “on an island”; it reacts and causes reactions, all of which 
must be understood and balanced. We design systems based on our understanding of 
specialties and how they interact together. 

2. Insurance for survival of a product, program, or organization depends on its ability to 
develop a three-pronged interrelationship focus consisting of people (skills), tools (includes 
facilities), and technologies. It is, therefore, a learning organization that balances the three 
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aspects, where problem history analysis becomes the fulcrum of the process. Taking away or 
minimizing any one of the three prongs creates instability, ensuring the long-term failure. 
Taking away the fulcrum takes away the basis for any insurance. 

3. We must be constantly open to the challenges of the future, i.e., to changes and new tech- 
nologies that bring about change. These challenges are not only the bevy of technical moun- 
tains to climb, but must include processes, management, etc. Our openness to these chal- 
lenges implies that we must identify profitable changes and aggressively accommodate them. 

4. Successful engineering, organizations, and design are based on the quality of the people 
involved — personal competency. Every person individually and every organization 
collectively must be continuously growing (a learning organization). The message is two 
fold: (a) search for opportunities for growth and (b) treat every experience, good or bad, as a 
challenge for growth. Every situation contains those potentials. Look for them. Personal 
entrepreneurship is, therefore, the hallmark of nobility for successful design and organiza- 
tional growth. It involves empowerment, trust, constant training, and a learning environment 
that develops the total person. 

5. Criteria or legal requirements must be simple, concise, and direct, providing order to the 
engineering, but not overpowering to where they stifle creativity and remove responsibility 
(Dupree). Criteria cannot replace good engineering, they should be quiet aids. 

6. Models are just that, models, and are only as good as the assumptions used. 

a. All analyses are simulations that are not complete (limited), which attempt to predict 
trends and what will happen. Models are not, therefore, exact representations of physicals. 

b. A test (components, subsystems, systems, scale models, etc.) only partially replicates real- 
life situations. It is biased by the limited insight and provisions of the test engineer. You 
generally get what you are looking for. Improper boundary conditions can invalidate a 
costly test. 

c. How you put the analysis and test together in a cohesive unit to get a validated design is 
the major problem engineers face. 

d. Computer/codes are used as a cookbook and not as an extension of the human mind — a 
major error. Cookbook approaches save a lot of time and energy, but can and do miss the 
phenomenon. They are only aids to complement the human mind. 

7. What you do up front to understand the system determines the product’s performance and 
quality. Poor concept selection can never be righted with outstanding design engineering 
(Pugh). Spend the money up front and get the right concept, then good design engineering is 
effective. 

8. To ensure that design is practiced effectively and efficiently, it is necessary to utilize tech- 
niques that enable the team to operate the design activity. According to Pugh, the designer’s 
tool kit must include. 

a. Independent analysis techniques, modeling, etc., applicable to any project or discipline 

b. Dependent techniques and technologies/knowledge to include: 

stress 

thermal 
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dynamics 

fluids 


control and avionics. 

9. Leadership is the key to the future of any project/products’ success. The same is true of 
organizations. 

a. The metric of leadership is the individual and collective growth of its people 

b. The leader is a servant (Greenleaf, Covey, Dupree, Senge, Peck ) 

c. The people create the leader and give him the power 

d. Leadership is doing one action at a time 

e. Leadership interests, what he spends his time on, and the rewards passed out determine 
what he gets. 

10. Teaming is an effective approach to ensure project/program success. 

a. The team can perform little better than the skills of its people 

b. “The tendency of a team is to perform at the lowest level of its members. Leadership and 
synergy can raise its performance above the level of the best team members,” Senge. 
There is no one best teaming approach. The team approach selection must match the tasks. 

11. The concept selection and design process is key to a quality product: 

- Progressive, convergent, increasing in depth concept selection 

- Sensitivity and trades to identify key parameters 

- System focus 

- Interdisciplinary analysis/design. 

12. Requirements are the mantel that determine the product’s characteristics, good or bad. 

- Must be challenged with minimum constraints 

- Minimum change 

- Minimum required to maintain order 

- Leave room for creative design (do not dictate design). 

13. Models/analysis/simulations are virtual reality. Reality is in the hardware/system testing. 
Read it; the hardware contains the answer. 

14. Lessons from the past contain the keys to the future, if used appropriately. Used indis- 
criminately as points of departure for extrapolation can lead to major problems. 
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15. It is prudent to design for fatigue and fracture control, especially for reusable systems: 

- Two different design points 

- Materials characterization at right temperatures necessary 

- NDE must be quantified 

- Eliminate dynamic tuning as a fatigue mitigation technique 

- Proof testing has merit if properly used. 

16. All designs must have a system focus. Discipline focused skills must be sharpened and 
honed, but never in isolation: 

- Technical communication 

- Teaming 

- Interface control documents (ICD’s). 

17. Design for instrumentation during development, then test to off-nominal conditions and then 
to failure. 

18. You must constantly be aware of, and guard against, dynamic tuning between structural, 
fluid, mechanical, electrical, and acoustical systems. 

19. Rotordynamics has been a major design issue. Attack it up front and design for it: 

- Know environments 

- Model in detail 

- Test structures dynamically 

- Plan for damping augmentation 

- Pursue various options for rotor support systems. 

20. Cost, operations, manufacturability, and supportabililty must be a fundamental part of the 
design equation. Metrics must be developed to support: 

- Cost and operational efficiency requires a multipronged approach 

(1) Calculated risk-taking/management that obviously includes a detailed assessment of 
consequences must be a part of this risk-taking 

(2) Product improvement that reduces cost and improves operations; reduction of the 
number of parts, simplicity, and robustness are parts of this equation 

(3) Development of criteria and requirements that neither over-specify nor dictate the 
design solution. 

All this must be accomplished without violating basic physics and while using good 
engineering practices. 
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21. There is no small change. Effects of changes usually have large magnification factors. 

22. Failures will occur during design, development, and operations. Through the use of concur- 
rent engineering teams composed of a cadre of all the potential specialists involved, 
including manufacturing and processing, and using a formal fault tree approach (fishbone 
works just as well),. the probe causes and solution can efficiently be found. All organizations 
should be trained early in both teaming and fault tree analysis. 

23. Regardless of the technical adequacy/integrity of the answer, it always has to be sold politi- 
cally; therefore, it must become part of the design culture either by changing the culture or 
the recommendation. In other words, the proposal must always be politically viable. 
Engineers, therefore, must also be salesmen. 

24. Quality must be built in, not inspected in. Inspections are only for insurance; therefore, 
quality must be a mainstay in the design team’s discipline makeup. 

25. Understanding and using statistics/probabilities approaches are fundamental for conducting 
studies, evaluating data, manufacturing hardware, understanding and quantifying sensitivi- 
ties, and performing operations. 

26. Maintaining electronic data bases of analysis, tests, and flights are necessary and should be 
planned for. Electronic transfer of data and networking is necessary in today’s multilocation 
workforce. Communication is aided greatly by these approaches. 

27. Design of experiments is an effective tool for both analysis and test planning and should be 
in each engineer’s tool kit. 

It would not be appropriate to conclude this report without making some statement as to the 
future challenges that face space exploration and what some of the present technology focus implies. 
The biggest challenge facing space exploration is, “How do you effectively consider cost along with per- 
formance and reliability as design metrics?” The biggest problem is obtaining the cost metrics so that 
appropriate trades can be made and a true optimum system designed. This is complicated by the fact that 
part of the cost metrics indicates higher performance and fewer launch stages, which greatly complicates 
the equation since higher performance indicates greater sensitivities to uncertainties that include, but are 
not limited to, manufacturing, environments, operations, and evolving requirements. For example, a 
single-stage-to-orbit (SSTO) launch vehicle must balance three different efficiencies to narrow margins 
if it is to meet both performance and cost goals. To a large extent, meeting these is a paradox in that to 
get one will result in a costly change in another. The three keys are: (1) a highly efficient propulsion 
system that not only includes Isp, but includes thrust and thrust-to-weight, (2) structural or dry mass 
efficiency (this is not only the basic structure, but includes TPS, components, avionics, etc.); and (3) to 
manage the losses (managing the margins) that includes technology readiness degradations, 
environments surprises, etc. Past launch vehicles had many impacts due to not properly managing the 
losses, resulting in load increases, inefficient trajectories, etc. Managing the losses effectively is a major 
challenge This means that sensitivities must be well understood, traded, and managed. For example, 
high acceleration during the near-Earth phase of flight is efficient for managing gravity losses, but 
creates unacceptable loads for the structure and for the humans. True optimum trajectories create large 
aerodynamic loads, which are not acceptable. Load relief control reduces these loads, but introduces 
path deviations, thus performance loses. Then when the vehicle moves back toward the optimum after 
leaving the high-density part of the atmosphere, large angles of attack are introduced, increasing thermal 
environments. Leaving the Earth’s atmosphere, Isp is important for propulsion system efficiency. 
Clearly then, understanding environments, sensitivities, and trades from a system viewpoint is 
mandatory in order to meet the challenges of the future. The same types of things are true for satellites, 
upper stages, etc.; however, the tent poles vary and are considered different parameters. 
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The hypersonic aerodynamic vehicle is getting a lot of emphasis and is a clear challenge of the 
future. The challenge basically follows the areas discussed in the proceeding paragraphs. 

Delivering a cost-effective, minimum operating, intense space station is still in front of us 
although much work has been accomplished. Much fine tuning and effective procedures still must be 
developed. 

Payloads, satellites, science, upper stages, etc., face the same set of challenges — reduced cost 
while maintaining performance. This is very difficult for all systems. The challenge is to break the 
cultural loop, reducing criteria, etc. For example, satellite missions could be structured so that more, but 
much smaller, systems could achieve the same goals without the big costly one-of-a-kind satellite, where 
a failure is a tragedy. The challenge is not only to attack how we can build and operate the system 
cheaper, but also how we plan for achieving science. 

Finally, the prime challenge is to get back to the basic that accepts failure as a stepping stone to 
knowledge and not a failure. Engineering today cannot tolerate failure, which is leading to a protection 
(low risk) design that in the end will stifle space exploration. Space exploration involves risks, risks that 
must be calculated and minimized but not eliminated. Probably this is the hardest task engineering faces 
in the future. 


168 



APPENDIX A 


The purpose of this appendix is to provide, by projects, a listing of the various problems 
encountered and understood by the author (not the total set, since they were in disciplines not part of my 
experience). The problems are summarized in matrix form, giving problem areas, problem statement, 
problem cause, and problem resolution. In some cases, an outline of the problem matrix precedes it. This 
brief summary should provide engineers with a starting point for design problem avoidance. It should be 
recognized, however, as was stated previously, that every design is a design of compromises and a 
design for failure, hopefully at a predetermined time and condition. Thus, problems cannot be avoided — 
they are in the nature of design. Over design, as well as under design, can kill. Design is a balancing act. 

In addition to the problem matrices, specific lessons learned are discussed and, in some cases, 
particularly for the SSME, additional discussions of specific problems not discussed earlier in this paper 
are presented. It is hoped that this added discussion will provide some more indepth insight into the 
influence that high-performance requirements have on product sensitivities and problem occurrences. As 
the author has pointed out in other publications, the sensitivity of the system varies nonlinearly with the 
performance requirements . 1-3 The sensitivity is not only to environment unknowns, but includes 
requirement changes, manufacturing tolerances and mishaps, and hardware aging. The SSME is a great 
example of an outstanding machine that has high performance. The same is true of the total shuttle 
vehicle and also for the HST. The key lesson to grasp is the total design process, so that during design 
and development, shortcuts are not taken that lead to repeating past problems. 


I. REDSTONE/JUPITER 


The author’s scope of activities was much narrower during the Redstone and Jupiter programs; 
therefore, the matrix of problems is greatly restricted. However, the impacts of these problems on our 
thinking and lessons learned were probably the greatest of any program. The problems experienced 
taught some very powerful lessons, including insight into several system interactions. 

The structural control jitter that occurred on Redstone during control system checkout, while the 
vehicle was horizontal in a cradle, illustrates the subtleties of structural dynamics and control coupling. 
The spacing of the potentiometer was such that the stepwise control impulse tuned with the first bending 
mode. Dynamic coupling is a major concern in designing space systems. The fix was simple; break the 
coupling loop either with a filter or use a continuous rate gyro pickup (sensor). Propellant sloshing 
taught the same lesson in vehicle systems interactions. Sloshing also illustrated the need to have good 
simple models of the dynamic characteristics. 

Redstone and Jupiter reinforced the need to develop technologies, models, and data pertinent to 
the project under development. No project can work all the potential technologies, etc.; therefore, 
informed prioritization of tasks is required for program efficiency. 

The matrix (table A-l) lists the key problems from control coupling, to aerodynamics, and to 
thermal protection. The thermal problems were plume heating and the payload reentry, both requiring 
protection of components and structure from the heating environments. Extensive effort has been spent 
in the years since Redstone and Jupiter to further define both reentry and plume heating environments 
and protection systems. The development of the effects of plumes on launch vehicles is a very complex 
technology, from both an analysis and a testing standpoint. Scaling plumes in test, as well as 
measurements during flights, is very difficult. Plumes not only produce base heating, but affect vehicle 
drag, shift aerodynamic distributions, etc. Clearly, individual disciplines such as propulsion system 
design create system problems due to systems interactions, as discussed above. All successful projects 
have a good systems focus. Designers and engineers should not only be specialists, but must have a 
system focus. 
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T able A- 1 . Redstone/Jupiter. 


Element 


Problem 


Problem Cause 


Problem Solution 


Redstone 

Control 


Closed loop vibration of 
structure/control systems 


Rate gyro potentiometer 
feedback as wiper arm 
jumped between wires 
from structural dynamic 
excitation, drove 
vanes/rudders, further 
exciting vehicle structural 
dynamics 


Redesigned gyro pickup to 
provide a continuous 
signal 


Vehicle 


Oscillating shock off the 
nose cone setup acoustical 
excitation 


Angles of nose cone, etc., 
coupled with flow field 


Designed structure to 
withstand oscillating load 


Aerodynamics 


Aerodynamic loads during 
ascent through jet stream 
created large structural 
stress fields 


Wind-induced angle-of- 
attack produced large 
aerodynamic loads on 
vehicle structure 


Load relief control logic 
using Edcliff vane angle- 
of-attack meter to generate 
an angle-of-attack control 
signal allowed vehicle 
rigid-load relief (evolved 
for Jupiter to pressure 
sensors then to 
accelerometers) 


Guidance/Control 


Performance loss due to 
wind, etc., induced trajec- 
tory drift from optimum 


Vehicle attitude control 
responses to winds, etc., 
caused deviations from 


Developed drift minimum 
control laws that balanced 
between attitude control 




optimal flight path 

and path deviations. 

Jupiter 

Vehicle 

Instability of control 
system during max “q” 
caused loss of vehicle 

Propellant slosh dynamics 
coupled with the control 
system causing unstable 
feedback and forced by the 
trajectory tilt step 
command 

Introduction of propellant 
damping into the 
propellant tank and base 
lining of a continuous rate 
gyro signal pickup 


Loss of control during max 
“q” due to loss of control 
signal, loss of vehicle (first 
flight) 

Plume heating/recircula- 
tion burned the control 
signal wires to the 
actuators, causing loss of 
control signal 

Design and installation of 
protective heat shield over 
vehicle base with movable 
port to accommodate 
engine gimbal 


Aerodynamic unstable 
vehicle control without use 
of fin (aerodynamic 
compensation) 

Control authority require- 
ments were excessive 
using jet vanes or injection 
methods 

Designed, developed, and 
implemented an engine 
gimbal ball to take out the 
thrust loads and gimbal the 
engine 7° in each axis for 
control; roll control 
accomplished using reac- 
tion jet control system 


Payload reentry thermal 
environment excessive 

Aerodynamic heating 
during reentry 

Designed, developed, and 
implemented ablative 
covering of the structure, 
eliminating the problem 
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II. SATURN/SATURN APOLLO/SATURN SKYLAB 


These programs were the foundations of space exploration, ending with the “Moon walk” and 
the Skylab space station. The problem list (table A-2) again is restricted due to the author’s experience 
level on these projects, but is very significant in terms of lessons learned due not only to the fact it was 
on the frontier, but also the magnitude and scope of the endeavor. Landing a man on the Moon and 
returning him safely to Earth was a major achievement. 

Saturn clearly emphasized the importance of dynamics, dynamics and control interaction, and 
systems focus in the design, development, and operations of complex launch systems. Most of the tools 
and techniques of dynamics have their roots in the Apollo program. The importance of fracture control, 
particularly for propellant tanks, was realized, with the first use of proof testing tanks starting on Saturn. 
Buckling of large propellant tanks was brought to the forefront, teaching the need to design for, and 
understanding potential failure modes, particularly those that have a medium-to-high risk of occurring. 
Saturn indicated that it was prudent to design for robustness in order to have flexibility during develop- 
ment and operations, as was discussed previously. Although in today’s world of austerity, it probably is 
not feasible now, Saturn clearly showed the advantage of evolutionary design using prototypes or flight 
test vehicles to develop and verify critical subsystems, etc., as was done using Saturn I and IB. Saturn 
was an excellent example of taxing the current program to provide facilities and technologies for future 
systems. The plume heating technologies, dynamic and static structural test facilities, hot fire propulsive 
test facilities, finite element structure modeling, modal coupling, etc., are examples. 

The matrix (table A-3) contains some of the problems that occurred during the Saturn program. 


III. SKYLAB SPACE STATION 


The Skylab space station was the first long-term American demonstration of humans living and 
working in space. The human perspective was not only utilized to conduct science, but was the key to 
saving the spacecraft due to the problems experienced during ascent launch. This was exemplified in 
several ways by the several repair activities that occurred during the first two missions. The first was 
releasing the hung-up (undeployed) solar array (the other solar array was lost during ascent) and 
deploying a Sun shade (parasol) out the small workshop port. Releasing the stuck solar array required 
several tries during EVA’s, finally cutting the strap that constrained the array with bolt cutters. These 
activities, along with orientation changes, etc., put the station back in working order and allowed a full 
duration mission of the ATM and other sciences. On the second mission, a larger more effective Sun 
shade was carried up and installed using astronauts EVA further enchancing the operational capability of 
Skylab. During the mission, a few other problems occurred, all of which had more than adequate 
workarounds. 

The Skylab missions taught many lessons, the most important being “that the ability to recover 
from major problems is the secret to successful projects.” Human presence in space greatly enhances the 
ability to recover from problems that occur. The other major lesson clearly was: do not create a gap in 
the Nation’s launch capability. Since the shuttle had not flown and the Saturn program had been 
canceled, the orbit decaying Skylab station could not be reboosted, although it was still functioning and 
could have served as an interim station. The robustness built into Skylab allowed the potential, even 
though Skylab had been inactive many years. 

The matrix (table A-3) lists some of the key problems Skylab experienced during development 
and operations. 
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Table A-2. Saturn. 



Problem 


Wind sounding balloon was unstable 
during ascent, creating erroneous 
data 














Ground winds caused a vehicle 
oscillation while attached to the pad, 
creating large base bending 
moments 


SI-C oscillating plume 


S-II oscillating shock 


SIV-B panel flutter 


SIV-B propellant utilization (PU) 
guidance and control coupling 


Excessive max “q” loads due to 
wind gust and steady-state winds 


Excessive instrument unit deflection 
at the rate gyro location created 
control/structural inaction instability 


Hydroelastic (shell mode propellant 
dynamic coupling) 


Dynamic test data contaminated by 
vehicle test suspension system mode 


Simulating free-free conditions for 
launch vehicle dynamic test 


Problem Cause 


Balloon was smooth-skinned, 
creating a type of vortex shedding, 
inducing unwanted balloon 
oscillations 


Vehicle longitudinal bending modes 
coupled with the hydroelastic tank 
and acoustical propellant duct 
modes, creating oscillating thrust 
that amplified the structural 
oscillations (unstable) 


Same as Sl-C pogo; filling 
accumulator during S-II engine start 
gave a short-term tuning of 
structural and propulsion system 


Vortex shedding of cantilevered 
vehicle attached to launch pad 



Stiffness/frequency of panel was too 
low, causing structural panel mode 
to couple with aerodynamics 


Propellant sloshing gave a dynamic 
oscillation of propellant level, 
creating guidance and control 
signals that feedback, increasing the 
propellant oscillation 


Rigid-body accelerometers load 
relief control amplified gust induced 
vehicle structural dynamics 
response; rigid-body wind angle-of- 
attack coupled with attitude control, 
creating large aerodynamic loads 


The load path from the service 
module came in at an angle through 
the fairings, creating local deflection 
at rate gyro location, increasing 
structural gains, introducing 
instability 


Inability to model coupling between 
fluid and structure 


Dynamic modes of suspension 
system coupled with vehicle lateral 
bending 


Vehicle constrained at base does not 
simulate free-free flight conditions 


Problem Solution 


Redesigned the balloon to have 
spikes patterned after golf ball 
dimples to eliminate the unwanted 
oscillations 


Designed and installed an 
accumulator on the feed line, 
detuning the system; no occurrences 
of SI-C pogo since 


Problem was shown to not be 
damaging; no fix instituted 


Designed and installed damper near 
top of vehicle between vehicle and 
service tower 


Lived with problem; no observed 
impacts 


No impacts 


Stiffened panel, raising frequency 


Designed a filter to filter out the 
slosh dynamics, giving steady-state 
fuel level signal; due to other 
problems, PU was eliminated 


• Eliminated rigid-body load relief 

• Instituted monthly mean wind- 
biased trajectory 

• Instituted control to augment 
structural damping in first two 
lateral bending modes 


Changed location of rate gyro where 
local deflections were not present 


Developed finite element model of 
fluid and structure and verified with 
dynamic test 


Tied suspension cables at the center 
(2 by 4) to test stand to shift cable 
frequency 


• Suspended vehicle using elastic 
cables 

• Suspended vehicle base on an oil 
bearing (free- free lateral modes 
only) 
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Table A-2. Saturn (continued). 


Element 

Problem 

Problem Cause 

Problem Solution 


Scale model dynamic test mode 
contamination 

Manufacturing tolerances not scaled 
as vehicle geometry created 
nonlinear movement in tolerance 
space 

Scaled manufacturing tolerances to 
same scale at the vehicle geometry 


Complex modes of clustered tanks 
difficult to model 

Individual propellant tanks of cluster 
dynamically coupled, creating 
complex load paths and dynamic 
models 

Generated special models that 
produced individual modes of tank 
elements with appropriate boundary 
conditions and then coupled them to 
system using Lagrangian equations 
and verified by dynamic test; this 
was a forerunner of present day 
model coupling techniques 


SIV-B Skylab fairing failure during 
ascent damaging Skylab solar arrays 

Improper venting of solar array 
compartment during ascent caused 
delta pressure buildup that failed 
fairing and solar array 

• On-orbit installation of new 
Skylab thermal shield 

* Astronauts space walk to free 
second solar array 


Increased vehicle loads during 
ascent for Saturn V Skylab 
configuration 

Aerodynamic shape change due to 
elimination of command/service 
module, creating big change in 
aerodynamic distributions, creating 
large moment 

Cleared for launch using monthly 
mean wind biasing and probabilistic 
instead of deterministic loads 
analysis 

Engines 

Propellant feedline gimbal bellows 
had a flow instability 

Fluid flow across bellows created 
flow instability (type of vortex 
shedding) 

Installed liners inside the bellows, 
eliminating unsteady flow 

SIV-B Stage 

SIV-B shell mode coupling with 
control 

The deflection/ frequency of shell 
mode created dynamic control 
structural coupling that was 
feedback, creating instability 

Designed and installed a control 
signal filter, eliminating unwanted 
shell mode dynamics 


Large fluid motions created at 
engine shutdown on orbit 

Energy conservation from high g to 
low g greatly amplified propellant 
dynamics, reducing propellant 
ullage pressure and potential engine 
restart problems 

Installed large nylon baffles 


Zero-g sloshing instability 

Coupling of sloshing dynamics with 
control system 

Tailored control system logic and 
installed slosh baffles 


No slosh damping in lox tank 

Baffle orientation was such that 
propellant flowed along baffle 
instead of against it; propellant 
surface is perpendicular to vehicle 
acceleration vector (acts as a free- 
falling object) 

Reoriented slosh baffle 


Inadequate slosh model 

Slosh model did not contain rotary 
inertia effect of propellant sloshing 

A rotary inertia term to slosh model 


Slosh dynamics characterization 
beyond computer capability when 
vehicle dynamics and control were 
added 

Solution of hydrodynamics 
equations consumed computer 
capability 

Developed mechanical analogy 
(mass spring damper) to 
hydrodynamic solution by curve 
fitting model parameters; verified 
with dynamic test 
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Table A-3. Lessons learned. 


Element 

Problem 

Problem Cause 

Problem Solution 

1 Skylab 

ows 

Loss of meteoroid shield 

Aero proturberance and 
improper venting of m/shield 

Improved systems analysis 

ows 

EBW failed functional test 

Conformal coating flow caused 
circuit interruption 

Changed to maintain close, tight 
fit to prevent flow 

OWS, ATM 

304 CRES corrosion caused 
CDF end fitting to split 

Intergranular corrosion caused 
by carbide precipitation of the 
grain boundaries and exposure 
to moisture 

Metal reinforcement added for 
Skylab ; process changed for 
future hardware 

ATM 

False stars for star trackers 

Explosive components with 
metallic name plates and LD. 
tapes caused false stars for the 
star trackers 

Material change 

OWS 

Viton static seal leak 

Cold flow plus sterilizing 
process accelerated the problem 

Changed to silicon seals; 
considered nonoperational 
environments for materials 

OWS 

Ice bridge from liquid dump 

Liquid contacted another 
surface before the liquid 
changed to ice 

Do not let liquid contact another 
surface before phase into ice 

MDA 

Moisture leaks in payload 
shroud 

Overpressurization purge is 
inadequate to prevent rain leaks 

Payload shrouds must be water 
tight 

OWS 

Paint debond 

Wear and flaking 

Use adhesive-backed materials 
or permanent finishes 

Airlock 

Coolant leak 

Mechanical connections 

Weld or braze connections 

Airlock 

Reduced heat exchanger flow 

Dust/debris accumulation 

Incorporate replaceable filters 

OWS, airlock 

Sticking valves 

Particulate contamination 

Avoid small clearances, filter 
placement, use ultrasonic 
cleaning 

Spacelab 

SL racks 

Rack STR margins 

Load increases 

Include good margins 

SL avionics air system 

Resource demand 

Very limited resource 

Allow for flow degradation due 
to filter blockage or schedule 
time for cleaning 

SL module 

New hardware stowage 

Fit check too late in KSC flow 

Fit check with flight hardware 
prior to flight flow sequence 

SL condensate dump 

Orbiter wanted to dump with SL 
system 

Not possible since correct 
Q.D.’s were not stowed 

Add correct Q.D.’s to SL or 
orbiter stowage 

SL IML-2 

CO 2 level requirement from 
principal investigatory (P.I.’s) 
not defined early 

Late definition of low CO 2 
requirement 

Early definition of requirement 
important 

SH 

Window cover thermal 
constraints violated 

Crew failed to install cover 
before solar exposure 

Develop better timeline for 
requalifying window 

SL remote acquisition unit 
(RAU) 

Data skips with increased freon 
temperature 

Design deficiency and limit 
quality testing 

Hardware modification 

Space Station 

Modules 

Condensation 

M/D attachments and 
penetrations 

Guard heaters 
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Table A-4. Space shuttle systems. 


AERO 

Problem 

Problem Cause 

Problem Resolution 

Aerodynamics 

Wing load increased over design; 
discovered on first shuttle flights 

Inappropriate plume simulation in 
wind tunnel testing led to 
inaccurate aero distribution 
prediction 

Beef-up wind leading edge 
Change max “q” trajectory from 
-2° to -6° 

Accepted 5,000 performance hit 
and launch probability reduction 
Wind constraints 
Day-of-launch I-load update 


Lift-off acoustic 

Payload near the propulsion noise 
source 

Water injection into propulsion 
system flames 

Ignition transient 

SRB ignition thrust created 
overpressure wave that dynamically 
drive the vehicle to 1 to 2 g’s 
response during lift-off on STS-1 

Expanding SRB thrust compressed 
air in flame trench/bucket, creating 
overpressure wave 

Water in injection 
Water troughs for blockage (based 
on 6.4 percent propulsive model 
hot- fire test) 

Characterized SRB pressure effects 
on stiffness, also internal pressure 

Loads 

High sensitivity of structural loads 
during lift-off to model and 
environment uncertainties 

Dynamics of four bodies plus 
payload are such that the elements 
tune dynamically with low 
damping, which creates high gains 
and large sensitivities to frequency 
content of environments 

Dynamic test of elements and total 
configuration 1/8, 1/4, and full 
scale 

300 mode dynamic lift-off analysis 
for loads accuracy 
2-sigma worse-on-worse parameter 
variations for design loads 
26 discrete design load cases 
Time delay of SRB ignition to min 
stored energy condition 
Staggered SSME start and abort 
shutdown 

100 percent SSME lift-off 
SRB case elongation characterized 


Element-to-element interface loads 
sensitive to aerodynamics and 
thrust vector variation 

Aerodynamics and propulsion and 
control forces created at two points 
between each element 
Small variations in environments 
are reacted through long moment 
arms 

Body-to-aero variations included in 
design load 

Structural beef-up in ET 

Dynamic 

External lox tank buckling 

Propellant weight without internal 
pressure 

Beef-up structure through increased 

skin thickness 

Fill tank against pressure 


External H 2 tank oil canning during 
model excitation 

Dynamic test was conducted at 
room temperature; therefore, SRB 
to ET struts were canted 
approximately 1 \ introducing roll 
moment into aft main frame 

No fix required because flight will 
be at cryo temperature; therefore, 
struts will be perpendicular to tank 
and main frame 


SRB/ET/orbiter roll modes 

The unsymmetrical coupling of the 
elements through the interfaces 
creates a rolling motion of the 
element and pivoting of the 
interfaces 

Detailed dynamic test 1/8, 1/4, full 
scale 

Characterization of propellant 
dynamics, pressure effects, etc. 
Detailed finite element models of 
elements modal coupled together 


ET lox tank hydroelastic damping 
very low at high fill levels 

Coupling between fluid dynamics 
and structural shell modes of tank 

Detailed 3-D finite element 
hydroelastic model generated to 
mature modal characteristics 


1/4 scaling impacts on 
manufacturing 

Testing in 1-g environments using 
standard manufacturing problems, 
creates exaggerated effects of joint 
slope, etc. 

Redefined all manufacturing 
tolerances for 1/4 scale to 1/4 of 
standard tolerances 


1/4 scale SRB attach fixture 
distorted dynamic response 

Tolerances of the aft SRB strut to 
ground fix was not rigid to ground, 
changing test boundary conditions 

Redesigned test fixture to ensure 
rigidity 


175 














Table A-4. Space shuttle systems (continued). 


AERO 

Problem 

Problem Cause 

Problem Resolution 

Interdisciplinary 

analysis/interaction 

Load relief control impacts 
performance, thermal 
environments, flutter boundaries, 
and control authority 

Performance loss due to “q” 
constraints 

SRB holddown bolt hangup 
creating potential lift-off clearance 
problems and extended hole in the 
aft skirt 

Day-of-launch constraints reduce 
launch probability, causing launch 
postponement for four shuttle 
launches 

SRB reentry imposed separation 
conditions, impacts performance 

Load relief drifts the vehicle off the 
optimal trajectory; corrections 
introduce large heating 
environments and increases control 
authority requirements 

Meeting loads and flutter “q” 
constraints requires combination of 
SSME throttling and trajectory 
lofting 

Throttling approximately 25 lb per 
1 lb/ft 2 of “q” 

Lofting approximately 275 lb per 1 
Ib/ft 2 of “q” 

Uneven firing of pyrotechnics of 
frangible nut caused bolt to wobble 
and hang up 

Winds aloft create dynamic 
pressures and loads greater than 
vehicle capability 

SRB separation conditions “q” and 
a creates nonoptimal trajectory 

Tailoring between control, loads, 
performance loss, and heating 
environments 

Gimbaling of SRM nozzles for 
control authority 

Partial reduction of performance 
through adaptive SSME throttling 
Day-of-launch Moad update 

Tested characterized bolt pyros 
Improve pyro firing electronics 

Adaptive SSME throttling 
Day-of-launch I-load update based 
on launch minus 2-h wind profile 
(problem not totally resolved; still a 
probability of launch hold) 

Optimize requirements between 
SRB reentry and vehicle ascent 
trajectory 

Attrition criteria change 
Parachute size increased 

STS-51L, Challenger 

Vehicle destroyed during flight due 
to failed SRM causing loss of 
vehicle control 

O-ring not sealing assembly 
segment joint due to low launch 
temperature and distorted case for 
reuse 

Joint was redesigned using three 
O-rings and a y-clamp tank 
interface 

Flight suspended to redesign and 
verify joint 

Orbiter tile 

Debris damages orbiter thermal 
protection tiles, creating potential 
safety problems and cost 
refurbishment 

ET insulation deadband 
Runway debris 
Pad debris 

Holddown bolt pyro debris 

Changed ET bonding and 
inspection criteria 
Redesigned holddown bolt 
container 

Prelanding pad and runway 
cleaning 

Control authority 

Inadequate control authority during 
ascent using elevons and SSME’s 
only 

Aerodynamic/gust response 
Thrust misalignment 
Thrust mismatch 

Redesigned SRM nozzle to gimbal 
±7.5° after PDR 


IV. SPACE SHUTTLE SYSTEMS 


If the space shuttle taught one lesson, it was that the system effects predominated the vehicle 
characteristics and the problems experienced. Therefore, system requirements and integration are key 
elements for aerospace systems quality and, thus, success. It clearly taught a second lesson: “that the 
higher the performance requirements, the higher the sensitivities to system interactions, environments, 
uncertainties, manufacturing tolerances, and operational complexity.” The matrix of problems, coupled 
with the previous discussion, should give the reader a hint at these two profound lessons. The space 
shuttle made very clear that design is a balancing act between conflicting requirements. The balancing of 
these conflicting requirements requires interdisciplinary analysis and testing in order to properly 
quantify the key parameter sensitivities and the trade factors. 

The use of working groups and panels in a pseudo-concurrent engineering teaming fashion is an 
efficient means for handling both the discipline technical issues and the systems issues and trades. 
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Managing shuttle was a major challenge since it involved several major contractors and several NASA 
field centers. The working groups and teams contributed greatly in meeting the management challenge. 
Another clear lesson from shuttle is that many development problems can be alleviated with operational 
procedures, etc.; however, they in general carry a high price tag. 

The problem matrix (table A-4) lists some of the key problems encountered and solved. Many 
have been discussed previously in this paper or in other reports and papers. The missed aerodynamic 
distribution created problems that must still be dealt with operationally today. The solution to the 
overpressure problem on STS-1 was major. The sensitivity at lift-off to the release dynamics has 
impacted not only the vehicle structure, but also the payloads it flies. Future vehicles should attempt to 
design a release at lift-off that does not store high levels of energy that have to be released dynamically 
at lift-off. The multibody asymmetrical configuration clearly contributed to this problem. 


A. Space Shuttle Main Engine 

The SSME, being a reusable high-performance liquid propulsion engine, has taught many valu- 
able lessons. These lessons have been both general in nature as well as very specific technically. The 
first major lesson is “high-performance requirements drive sensitivities, thus for reusable systems, 
problems in fatigue and fracture. Fatigue and fracture then must be a major part of the design and opera- 
tion of these high-performance systems. Welds in these systems should be designed to have lower stress 
than the parent material, reducing fracture and fatigue concerns. Welds should be eliminated where 
possible. Stress concentrations should be reduced or eliminated. The design should accommodate NDE 
as well as repairs. This is particularly true for welds. Materials properties should be well characterized 
for the operational environments, particularly for fatigue and fracture. Design development hardware for 
instrumentation so that environments and dynamics, etc., can be verified. High energy concentrations 
such as turbomachinery are very susceptible to instability problems such as whirl and must have design 
augmentation to control potential problems. Dynamic tuning between structure, flow, and acoustics is a 
major source of problems not only in turbomachinery, but also in all high q flow areas and combustion 
devices. Many of these problems cannot be predicted; therefore, one must be prepared for problem 
occurrence and have established problem investigation tools such as fault trees available and understood, 
otherwise problems can grind programs to a standstill. In summary, high-performance liquid engines are 
very complex, environmentally, dynamically, thermally, etc., requiring indepth technical penetration and 
superior systems integration to ensure a quality product. Care must be exercised from design, manufac- 
turing, and operations view points. Hot firing of the system is required to understand, develop, and 
verify these systems. 

1. T.ox Pump Rearing Stress Corrosion . Stress corrosion is a problem that has plagued designers 
from the start of technology. The corrosive material starts a crack and accelerates its growth to failure. 
Since it is a known problem, great care is taken to manufacture and assemble hardware in clean rooms, 
etc. Drying and cleaning processes are also implemented to reduce the potential of a problem occurring. 
Even with these special efforts, small processing changes can result in unpredicted failures. Such was 
the case on the high-pressure lox pump that flew on STS-27. 

The SSME high-pressure lox pump is a high-energy (level and density) system that spins up to 
30,000 r/min. The shaft has impellers on one end to pump the cryogenic lox. The other end has a dual 
stage turbine that provides the energy. The shaft that contains these elements is mounted to the housing 
with ball bearings. The bearings are fitted on the shaft such that there is a constant stress on the inner 
raceway. This is accomplished by cooling the shaft and then inserting the bearings. The presence of any 
contaminant with water will start the process. In other words, the triangular relationship between the 
magnitude of the stress field, water, and contaminant leads to the failure. 

The cracked race was found with borescope inspection after the STS-27 flight (fig. A-l). Materi- 
als evaluation showed the cause to be stress corrosion. Chlorine was found on the part. The stress field is 
known within certain bounds. Lab tests have shown that the stress level present was sufficient to crack 
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HPOTP Turbine End Bearings 




the race in the time available. The frequency (external accelerometer) response data show that the crack 
was not present in the pump green run, but was present during the flight. When a failure like this occurs, 
a detailed investigation must be conducted on all manufacturing, transportation procedures, etc., to 
isolate a cause. 

What had happened was that Rocketdyne, in order to have more capability to support shuttle 
launches and development testing, built a new pump manufacturing facility for flight pumps. Some 
changes in the manufacturing process and drying procedures were instituted that were different from 
those used in the development pump room. The process in both facilities includes super cooling the shaft 
to get the shrink fits required. On these super-cooled parts, water can be condensed out of the air. This 
necessitates the drying procedure to eliminate the problem. For some reason, the drying procedure did 
not work properly, causing the cracked race. Changes have been made in the procedure, with no further 
problems occurring. 

2. Lox Pump Bearing Wear . The original high-pressure lox pump has had a problem achieving 
the required lifetime before refurbishment. One of the causes for early refurbishment was excessive 
bearing wear. The specific cause of the bearing wear has not been determined at this time, though most 
of the parameters that contributed to wear are known. The results of ground testing have shown various 
degrees of wear and indications of wear (cage harmonics in vibration and strain data), including pump 
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failure during engine hot firings. The last failure that occurred was engine 02/2 test firing 904-044. The 
following excerpt from the failure investigation report describes the incident. 

“On June 23, 1989, static test 904-044 of space shuttle main engine (SSME), unit number 0212, 
was terminated by the engine controller when the main combustion chamber (MCC) pressure redline 
limit was exceeded. 

“The purpose of the 1,338-s test was to evaluate the HPOTP block I bearing modifications, 
HPOTP weld 3 instrumentation and internal instrumentation. The planned test conditions included 215 s 
at 109-percent thrust, 550 s at 104-percent thrust, 90 s at 100-percent thrust, and 320 s at 96-percent 
thrust. Then two throttling profiles to 65-percent thrust were planned. Overall engine performance on 
904-044 was normal until 1,267 s when a slight downward shift in MCC Pc occurred as a result of 
downward shifts in HPOTP and HPFTP discharge pressures. Both prebumer oxidizer valves opened to 
rebalance the engine. At 1,270.67 s, a sudden, massive loss of lox flow from the HPOTP caused the 
MCC Pc to decrease such that the low Pc redline limit was exceeded and the test terminated. 

“Posttest inspection and engine teardown revealed mechanical failure of the HPOTP turbine 
section, rupture of the OPB bowl, failure of the MOV actuator and failure of the PCA. Disassembly of 
the PBP bearing package showed severe degradation of No. 2 bearing with cage destruction and 
excessive ball and race wear. The left-hand inducer blades had heavy erosion damage and slag formation 
on the suction surfaces. 

“The most probable cause of the mishap was failure of the PBP No. 2 bearing. Excessive wear of 
the balls resulted in mechanical damage to the armalon cage approximately 320 s prior to the mishap. 
The wear of the 440 C bearing and the breakup of the cage continued until several of the balls jammed 
in the outer race and skidded on the inner race. The frictional heating resulted in molten debris from the 
balls and races being ejected into the coolant. The high temperature particles were oxidized and forced 
into the left-hand side of the inducer. The subsequent erosion and promoted combustion on the suction 
side of the inducer by the high temperature particles created a large gas volume that unloaded the 
HPOTP. The speed of the HPOTP increased until the first stage turbine disc ruptured. The failure of the 
disc resulted in the failures of the OPB bowl, the MOV, and the PCA. 

“The HPOTP U/N 2216R1 on engine 0212 was a block I development unit. The mode included a 
thin-bladed inducer, 15-vane inlet, PBP bearing back pressure seal, reduced tolerance on PBP damping 
seal diameter, ion implanted bearings, elongated cage pockets, and increased coolant flow to the turbine 
end bearing. The time on U/N 2216R1 PBP No. 2 bearing and its failure mode were consistent with 
prior bearing failure. Based on the data and hardware evidence, none of the development features being 
tested were significant contributors to the mishap.” 

Evaluation of the dynamic data from external accelerometers, and strains mounted on the pump 
housing and internal strain gauges on the isolator and cartridge, showed a distinct event at 1,240 s, 
indicating some shift, apparently the cage cracking. At this time, the backpressure around the No. 1 and 
No. 2 bearings started rising, probably due to bearing residuals (cage and wear), stopping up the orifice 
until pump failure. On prior tests, at approximately 3,000-s total run time, the cage harmonics started 
showing on the internal strain gauges. The external strain gauges showed the harmonics around 40,000 
s. The 2X cage harmonic was present from the test start and became more and more organized. 

Cage harmonics exist because of uneven ball sizes. Theoretically, this is easily shown. The 
various ball size combinations produce different ball sizes. Though the cage harmonic signature 
characterizes relative ball sizes, it is also a good indicator of mean ball wear. The presence of cage 
harmonics in a pump green run test flight is a rejection criterion for flight worthiness. If one is interested 
in the details of this failure, secure the mishap report. 

The excessive ball wear is a major program cost that results from two sources: (1) pump 
rejection after green run and (2) the limited number of flights during which it is feasible to run a bearing. 
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Ideally, one should get at least five flights before teardown and refurbishment. Currently, this is not 
possible. Changes to improve the bearing life are in process. The turbine bearings wear can be 
adequately accessed after each flight by making a shaft micro travel measurement. The pump bearings 
(No. 1 and No. 2) are the main diagnostic problem. 

3. Engine and POP’s 2106 Incident . The combustion system/process has been the source of 
many problems in liquid propulsion systems. The source of the problems is the big energy source and 
the extreme environments that, when coupled with small changes, create problems. For example on July 
1, 1987, test 902-428 of engine 2106 experienced a premature cut-off after 204.12 s of a 700-s test. The 
test ended when the high pressure fuel turbopump (HPFTP) discharge temperature dropped below the 
disqualification limit. Inspection revealed moderate erosion of the oxidizer prebumer (OPB) faceplate 
and a bum through of the high pressure oxidizer turbopump (HPOTP) inlet housing. Leak checking of 
the OPB found a large leak due to braze cracking around a baffle. Metallurgical inspection of the crack 
surface showed 10 arrest lines that seemed to match with the 10 proof cycles seen by the hardware. 
Review of the test history found that this unit had experienced three large lox dome detonations (or 
POP’s) exceeding 8,580 g’s peak-to-peak, with the last one happening on test 902-427. Based upon 
these observations, it was determined that a poor quality braze joint was work hardened by proof cycles. 
The POP during test 902-427 then loaded the braze joint to failure. POP’s are caused during start and 
shutdown when a mixture of oxygen and hydrogen suddenly ignites (fig. A-2). POP’s can be controlled 
with start and shutdown sequencing, but not eliminated; therefore, the method of brazing has been 
improved and the shutdown sequence has been changed to reduce the chance of having damaging 
shutdown POP’s. Operationally, POP’s are monitored on all engines, thus all cut-off POP’s exceeding a 
threshold limit implement a faceplate deformation inspection and leak check. If damage has occurred, 
repair or replacement must be made. 

Reference: E2106 Incident Investigation final report. 
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Figure A-2. Shutdown POP. 
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4. HPFTP Kaiser Nut Failure . The inlet into the turbine portion of the HPFTP experiences hot 
gas temperatures of up to 1,444 °F. To protect the turbine bearing supports from this hot gas and guide 
vanes, a flow shield is installed, which is held in place by a nut. When the flow shield is viewed from the 
side, it resembles a World War I German helmet. Therefore, the flow shield and nut are referred to as the 
“Kaiser hat” and “Kaiser nut.” 

With the introduction of the “phase I full power level (FPL) engine,” three incidents of the 
Kaiser nut backing off have occurred. The first occurrence was on HPFTP 2008. The nut backed off and 
the flow deposited it into the first stage nozzle area, with the lock passing through the turbine. Then on 
HPFTP 9207, the nut and lock came off and the nut passed through the turbine. This time, several first- 
and second-stage blades were damaged. Finally, on HPFTP 01 10, the nut and lock again came off and 
were found in the first stage nozzle area. 

Instrumentation showed that the area of the nut was approximately 500 °F hotter than in the FPL 
engines. Analysis found that the nuts were failing in phase I engines due to the increased temperature. 
Various nut redesigns, locking features, and ceramic coatings were investigated. Failure of engine 2013 
was caused on the first use of a redesigned nut, which allowed a leak path for hot gas to reach the 
turbine end bearings. 

Ultimately, the problem was fixed with, in addition to a redesigned nut with no leak path, a 
different engine start and prebumer sequence. This sequence, certified in 1982, significantly lowered the 
temperature flowing into the turbine inlet and onto the Kaiser nut. 

5. HPOTP Capacitance Failure Incident . A premature engine cut-off occurred at 41 .80 s during 
test 902-120. A fire was observed in the HPOTP area. The failure investigation identified the fire origin 
in the area of a capacitor device. The initial mode of failure was thought to be yielding and/or structural 
failure of the capacitance package, which caused rubbing in a lox environment. In the early phase of 
SSME development, this special capacitor device was installed to measure the bearing loads and the 
rotation speed of the HPOTP. Since this device was initially intended to collect data for a better 
understanding of the bearing package area, its further use was discontinued. The message is clear; 
intrusive instrumentation in lox environments must be designed with great care. Technology is still 
needed for measuring the motions of rotating turbomachinery parts. 

6. Engine 0213. G-15 Crack . Joints between parts of a propulsion system, especially the engine, 
are a constant concern and source of many problems. The joint between the nozzle and main combustion 
chamber (MCC) of the SSME is an example. Upon disassembly of SSME 0213 the MCC and the SSME 
nozzle, joint G15 was exposed, showing the G15 seal to be buckled and cracked due to overheating. 
This occurred after 34 tests and 15,1 14 s of hot-fire time (fig. A-3). Also, three of the bolt holes on the 
nozzle were found to be cracked. However, a G15 joint leak-check done after the hot fire did not 
identify a leak. The MCC-to-nozzle combination on this engine had the maximum effective tube 
protrusion, which caused the nozzle coolant tube crown to erode and the flow restriction inhibitor (FRI) 
to deteriorate. The tube erosion, together with hot fire time, contributed to tube leaks (fig. A-4). 
Although tube erosion, leaks, and FRI deterioration were noted during the 34 tests and bluing and/or 
cracking of the seal was expected, the extent of the bluing and cracking was a surprise. Aerothermal 
analysis found that the high protrusion and cluster of vented or leaking tubes created an artificial 
(hydraulic) protrusion that directed core gas into the cavity. Discoloration of the G15 sealing surface 
indicated exposure to hot gas of approximately 2,500 °F. A similar occurrence was noted on engine 
0209, which had 0.077 in of effective protrusion and three leaking tubes. 

Based upon ground test experience with varying degrees of protrusion and/or gap, a life limit 
was placed on the hardware to assure a margin against the seal cracking. All life limits maintain a factor 
of two for each combination of protrusion and/or gap tested on the ground. Additionally, all flight 
engine G15 seal areas are inspected for the integrity of the FRI. If any FRI degradation exceeds the 
empirical data base, the nozzle is demated and the sealing surface is inspected. Currently, with the 
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Figure A-5. Recirculation heating gauged by tube protrusion. 

7 . Fuel Prebumer tFPB'i Tox Post Failure . As was discussed earlier, combustion devices are a 
concern. The lox posts that carry lox to the combustion chamber are typical of a class of problems that 
occur (figs. A- 6 , A-7, and A- 8 ). Two incidents of fuel prebumer lox post failures have occurred in the 
history of the SSME test program. Failure investigation of engines 0009 and 0204 found that the damage 
to the FPB was caused by similar failure mechanisms. Metallurgical examination of the lox posts from 
both of these engines discovered high cycle fatigue (HCF) cracks located at the braze fillet radius 
regions. Also, all engine 0009 lox posts exhibited cold worked material (austenitic to martensitic 
transformation) at the fracture location. Analysis and tests confirmed high main stage mechanical 
vibration and dynamic flow loads. Based on this, it was determined that the through cracks probably 
developed at the fillet radius during main stage, thus mixing lox and fuel. However, it was noted that 
although mechanical vibration was the main load source, it was insufficient to cause the damage. 
Probably, offset fuel sleeve holes caused an additional flow-induced alternating stress. This, when 
combined with the mechanical vibration stress, exceeded the material endurance strength. 

Based on these observations, an eddy current inspection technique was developed to determine 
the extent of the cold work at the fillet radius area due to fatigue. Metallurgical data determined that an 
eddy current reading of 5 V or more is sufficient to aggravate the fatigue failure. A method to reduce the 
fatigue load on the lox posts where eddy current exceeded or met a 5-V value was developed. This 
technique requires the placement of three support pins, equally spaced between the inner and outer 
sleeve annulus, thus, reducing the cantilever length and dynamic loads. All current flight prebumer lox 
posts are inspected at a predetermined interval and pins are installed if required. Also, an inspection is 
done to verify that all pins are in place or a fatigue damage algorithm is used to limit hardware use. 
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Figure A-6. Fuel prebumer. 
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Figure A-8. Fuel preburner element. 

In combination, these controls have stopped reoccurrence of this failure. In addition, a design 
change was made for the more recent two-duct powerhead configuration. This design change increased 
the thickness of the inner sleeve and reduced the cantilever length of the lox post sleeve. 

8. Test 901-222-Engine 0007. Heat Exchanger Fire Incident . The heat exchanger is used on the 
SSME to convert lox to gaseous oxygen (gox). This system is a series of tubes surrounding the oxygen 
pump prebumer, pump turbine region. Problems have occurred in the heat exchanger. For example, the 
first test of SSME engine 0007, test 901-222, was terminated at 4.34 s of a planned 50-s test. Engine cut- 
off was due to the exceedance of the heat exchanger outlet pressure minimum redline. Also, an external 
fire was observed in the area of the oxidizer prebumer. Extensive damage occurred to the combustion 
system, heat exchanger coil, hot gas manifolds, main injector, and associated ducts (figs. A-9, A-10, and 
A ll). ’ 

A failure investigation team was formed to investigate the cause of the incident and to identify 
corrective actions to reduce future failures. It was concluded that the incident was caused by a leak in 
the heat exchanger coil near the inlet and discharge area of the heat exchanger. Oxygen from the coil 
leak mixed together with the fuel-rich prebumer combustion gas and was ignited by the gas temperature. 
This failure could have been caused by one of two possible modes: (1) undetected damage to the inlet 
tube during reaming of the inlet for removal of the weld drop-through and/or (2) arcing damage 
associated with a heat exchanger welding operation at the coil support bracket. 
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Figure A-l 1 . Heat exchanger bifurcation joint. 

Corrective actions have been implemented for all future builds. Some of them are: (1) leak-test 
before each hot-fire test, (2) proof and leak check after each HPOTP installation, (3) visual inspection of 
the heat exchanger area for evidence of damage, arcing, or weld discoloration, (4) modify the 
manufacturing process to provide an electrical ground to the bracket being welded, (5) positive stop and 
pilot for reaming and horoscope inspection after reaming, (6) increased coil proof test pressure to 
provide a proof factor of 1 .26 instead of 1 .2, (7) improved leak detection requirement, and (8) purging 
coil using a high-velocity nitrogen purge to clean out any contamination or debris in the tubing or outlet 
area immediately before the installation of the inlet and discharge lines. In addition, all completed units 
were inspected to ensure that a condition similar to the failed unit did not exist. Together, these actions 
have improved safe engine operation. 

Tables A-5 through A-9 list the problems related to the SSME. 
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Table A-5. Outline of SSME problems. 


1. Turbomachinery 

a. HPOTP turbine blades/disks 

(1) First-stage turbine blade cracks 

• Radial shank 

• Radial platform 

• Radial firtree 

• Tip seal rail 

• Center plate rail 

(2) First-stage turbine blade h igh-cycle fatigue transverse shank cracks. 

(3) Second-stage turbine blade cracks 

• Radial airfoil 

• Radial shank 

(4) First-stage disk interstage seal pilot rib fillet radii cracking 

(5) Turbine disk curvic teeth damage 

(6) First- and second-stage disk firtree cracks 

b. HPFTP turbine blades/disks 

(1) First-stage turbine blade failures 

• November 1977 

• December 1977 

• September 1981 

(2) First- and second-stage radial airfoil cracks 

(3) First-stage transverse leading-edge airfoil cracks. Transgranular fracture. 

c. HPFTP whirl 

(1) Rotating assembly instability with three-stage pump interstage seal. Subsynchronous whirl 
vibration. 

(2) Phase II HPFTP subsynchronous vibration. Subsynchronous frequency ranges from 47 to 52 
percent, tracks pump speed 

d. HPOTP whirl 

(1) Phase I rotor is susceptible to second rotor mode whirl. 

(2) Rotor instability 

e. HPFTP bi-stable pumps 

(1) Periodic MCC pressure oscillations due to control system interaction with flow variations from 
HPOTP prebumer pump 

f. HPOTP bearings 
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(1) Turbine bearing inner race cracking 

(2) Delamination of No. 3 bearing cage 

(3) Bearing No. 4 wearing more than bearing No. 3 
h. Other HPQTP cracks 



Table A-6. Turbomachinery problems. 


a. HPOTP turbine blades/disks 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPOTP 

l.a.1 

First- stage turbine blade cracks 

• Radial shank 

• Radial platform 

• Radial airfoil 

• Radial firtree 

• Tip seal rail 

• Center plate rail 

Low-cycle fatigue caused by 
thermal shock 

Propagation is likely caused by 
sustained load hydrogen 
embrittlement 

High-cycle fatigue/chipping 
caused by damping contact 

DAR 2272: Life limited to 5,000 s 
and 21 starts; supported by 
statistical analysis (single flight 
reliability) and assessment of 
cracking as benign 


i 

First-stage turbine blade high- 
cycle fatigue transverse shank 
cracks 

Previous one-piece damper design 
did not provide enough damping 
against vibration. 

First-stage turbine blade redesign 
was two-piece damper. New 
design improved damping, 
reduced dynamic stresses, and 
corrected transverse shank 
cracking. Test history >600 tests 
and >250,000 s without cracking 


l.a.3 

Second-stage turbine blade cracks 

• Radial airfoil 

• Radial shank 

Low-cycle fatigue, 
thermomechanical 

Life limited by DAR to 5,500 s 
and 22 starts; supported by 
statistics (SFR), >550,000 s 
without transverse cracks 


l.a.4 

First-stage disk interstage seal 
pilot rib fillet radii cracking 

Failure mode is low-cycle fatigue 
assisted by internal hydrogen 
embrittlement predominantly 
driven by shutdown thermal 
shock, large strains caused by 
small radius 

Problem solved by redesigning 
with larger interstage pilot rib 
fillet radii, rework has passed 
certification, lift limited to 14 
starts before rework 


l.a.5 

Turbine disk curvic teeth damage 

Removal of excess gold from the 
curvic teeth results in gouges 
(fabrication induced) 

Life limited by DAR 2268 until 
reworked to remove gouges and 
restore to CEI life 


l.a.6 

First- and second-stage disk firtree 
cracks 

Low-cycle fatigue caused by 
thermal shock assisted by 
hydrogen embrittlement due to 
missing gold 

Life limited by DAR 2023 and 
2024 


b. HPFTP turbine blades/disks 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPFTP 
Sept. 1981 
Dec. 1977 
Nov. 1977 

l.b.l 

First-stage turbine blade failure 
(Incident No. 22) 

(Incident No. 5) 

(Incident No. 4) 

Localized high-temperature 
streaking from the fuel prebumer 
caused disbonding of the first- 
stage turbine tip seals; excessive 
rubbing of the blades caused blade 
failure, rotor speed decay and a 
resulting HPFTP inlet volute 
rupture and lox-rich shutdown 

• Elimination of the tip seal nickel 
plating (first stage) 

• Improvement in turbine inlet 
temperature profile 

• Tighter control on tip seal 
clearance at assembly 

• Improved retention of Kel-F 
seals (failure increased 
temperature/speed) 

• Decreased turbine temperature 
redline 

• Eliminated nonstandard plugging 
at lox posts in prebumer injector 

Sept. 1978 

Lb. 2 

First- and second-stage radial 
airfoil cracks 

Caused by thermal fatigue 

Eliminated by application of blade 
coating. Decreased start transient 
temperature spikes 

April 1979 

l.b.3 

First-stage transverse leading edge 
airfoil cracks; transgranular 
fracture (8 pumps with cracks) 

Crack propagation is HCF fatigue; 
caused by superposition of high- 
cycle excitation during test on a 
high mean stress caused by start 
thermal spike 

Problem reduced by modified 
engine start with reduction of start 
thermal spike (7/82); 22X inspec- 
tion intervals were specified (4/79) 

Feb. 1977 

l.b.4 

First-stage transverse trailing edge 
cracks 

High-cycle fatigue caused by 
damper/blade bonding 

Eliminated by elimination of 
plating on damper 
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Table A-6. Turbomachinery problems (continued). 


b. HPFTP turbine blades/disks (continued) 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

May 1978 to 
present 

l.b.5 

First- and second-stage platform 
cracks; intergranular and 
interdendritic cracks 

Caused by thermal fatigue 

Decreased start transient 
temperature spikes; required 
horoscope inspections on first- 
stage blades 

Nov. 1978 to 
present 

l.b.6 

First- and second-stage radial 
shank intergranular cracks 

Caused by thermal fatigue 

Decreased start transient 
temperature spikes; coating on 
first-stage blade shanks 

Dec. 1978 to 
Feb. 1991 


First-stage transverse upstream 
shank cracks; pressure and suction 
side comers (15 pumps) 

Low-cycle fatigue thermally 
induced 

Coating on first-stage blade 
shanks seems to have eliminated 
cracking 

June 1981 

l.b.8 

First-stage transverse downstream 
shank cracks (11 turbopumps) 

Thermal cycles initiate cracks 
because of local surface melting 
surface carbide, and comer stress 
riser; growth occurs due to high- 
cycle fatigue 

Phase II modes: recontoured and 
coating; no cracking with 
recontoured blades 

Nov. 1978 

l.b.9 

First- stage transverse firtree 
cracks; cracks at bottom firtree 
lobe (12 turbopumps) 

Transgranular fracture due to 
overload and assisted by hydrogen 
embrittlement 

Shotpeen and radoised firtree 
comers reduce acceptable 
microporosity size limits, mass 
finish, and optimized fabrication 
sequencing; reverse broach first- 
stage disk 

May 1977 

l.b.10 

Second-stage platform cracks; 
crystallographic fracture; pieces of 
platform lost; one crack turned 
and became transverse 

Fracture caused by stage one 
HCF; initiation on underside of 
platform at fretting caused by 
damper 

Boroscope inspect through 
turnaround duct; replace old style 
damper with new lighter precision 
damper 

May 1979 

l.b.ll 

Second-stage transverse 
downstream shank cracks; deepest 
crack 0.20 in 

Initiation at geometric stress riser; 
propagation due to stage 1 HCF 

Phase II modes; recontoured, shot- 
peened, and coated 

July 1978 

l.b.12 

Second-stage downstream firtree 
cracks (39 turbopumps) 

Crystallographic fracture assisted 
by hydrogen environment; 
initiation occurs at carbides at 
surface 

Stress relief and bead blast; shot- 
peen and radiused firtree comers, 
improved surface finish on firtree 
downstream face mass finish, 
optimized fabrication sequencing, 
reduce acceptable microporosity 
size requirements of recontoured 
shank 

Feb. 1978 

l.b.13 

First-stage damper pocket cusp 
cracks found in 1 5 turbopumps 

Thermal transient 

None - margin tested, risk 
minimal 

July 1978 

l.b.14 

First-stage turbine blade lobe 
cracking resulting from blade 
biasing 

A difference in the direction of 
broaching between the first- and 
second-stage disk 

Revise the direction of broaching 
of the first-stage disk to be the 
same as the second-stage disk 

HPFTP 

l.b.15 

Rotating unbalance of turbine disk 
(phase I HPFTP) 

The first-stage blades were coated 
with zirconium; zirconium has 
poor adhesion characteristics; loss 
of coating caused rotating 
unbalance 

Changed to Nicraly coating only 
on blades 

May 1990 

l.b.16 

First- and second-stage turbine 
disks curvic teeth; after gold 
plating, excess gold was 
frequently found on the load flats 
of the curvic teeth; upon excess 
gold removal, damage occurred to 
the fillet region of the curvic teeth 
on several disks 

Excess gold occurred due to 
insufficient masking; the damage 
occurred due to improper 
techniques for removal 

A rework procedure was 
established to repair the damage to 
the curvic teeth root radii; the 
reworked configurations were 
incorporated as new 
configurations for the first- and 
second-stage disks 

July 1991 

l.b.17 

E0215 failure; failure was due to a 
second-stage turbine blade 
fracture (incident No. 34) 

Blade fracture was due to a large 
internal flaw assisted by hydrogen 
embrittlement 

Limited blade life; established a 
computer tomography inspection 
criteria to attempt to flush pores 
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Table A-6. Turbomachinery problems (continued). 


b. HPH h turbine blades/disks (continued) 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

Oct. 1991 

l.b.18 

First-stage blade stop tab fracture; 
rub mark 360“ on fishmouth seal 
below lip; loss of blade stop 
creates a 2.33 gnm unbalance, 
which equates to a 0.2 grm 
increase in synchronous vibration 

Failure mode identified as 
hydrogen-assisted high-cycle 
fatigue; localized assembly 
stresses in blade stop radius in 
combination with operating 
environment 

Fragment is of insufficient mass to 
cause downstream damage; 
revised assembly procedure to 
preclude blade stop damage during 
installation 

April 1987 

l.b.19 

First- stage downstream pressure 
side comer lobe cracks 

Mechanically induced by grinding 
to remove excess gold 

Shotpeen and radiused firtree 
comers; elimination of gold on 
downstream face 

Feb. 1989 

l.b.20 

First-stage radial downstream 
firtree cracks 

Intergranular cracking 

Microporosity size limits; mass 
finish removes rough edges 


c. HPFTP whirl 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPFTP 

l.c.l 

Rotating assembly instability with 
three-stage pump interstage seal; 
subsynchronous whirl vibration 


Incorporation of straight, smooth 
sleeves and seals improved the 
rotordynamics stability; damping 
seals replaced smooth seals to 
increase the rotordynamic stability 
margin 

May 1988 

l.c.2 

Phase 11 HPFTP subsynchronous 
vibration; subsynchronous 
frequency ranges from 47 to 52 
percent, tracks pump speed on 
ramps, displays some wandering 
during a test, has split into dual 
peaks, and has modulated with 
pump speed; also, occurs less 
often with straight/smooth seals, 
and more often with lower side 
load 

The initiation of subsynchronous 
vibration is dependent on the 
turbine sideload; as shown by the 
presence of subsynchronous 
vibration on the FMOF TAD 
configured HPFTP’ s; there is no 
definite correlation between 
subsynchronous and rubbing 

Recommended that the 
incorporation of damping seals be 
included in the phase 11+ design 
for the two-duct HGM powerhead; 
not considered a problem for 
phase II 


d. HPOTP whirl 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPOTP 

l.d.l 

Phase I rotor experienced first 
rotor mode whirl at >50-percent 
synchronous speed 

The straight turbine interstage seal 
design enhanced the first rotor 
mode whirl; the scalloped 
interstage seal ring enhanced the 
gas preswirl in the inlet of the 
interstage seal 

Redesign of the turbine interstage 
seal to a tapered shape plus a swirl 
brake upstream enhanced the 
rotor's stability by removing the 
driving forces 

The scallops of the interstage and 
seal ring were eliminated, 
stopping the driver of the fluid 
preswirl and adding to the rotor 
stability 


l.d.2 

Phase I rotor experienced second 
rotor mode whirl at 90- percent 
synchronous speed 

The labyrinth seal design 
increased sensitivity to second 
rotor mode whirl 

New prebumer pump damping 
seal design reduces response 
amplitude and provides additional 
second-mode stability margin; 
subsynchronous whirl no longer 
exists 


192 













































Table A-6. Turbomachinery problems (continued). 


e. nruir oi-stao 
Component 

e pumps 
No. 

Problem 

Problem Cause 

Problem Solutions 

HPOTP 

l.e.l 

Periodic MCC pressure 
oscillations (thrust variation 
exceeds CEI allowable) due to 
control system (OPOV position) 
interaction with flow variations 
from HPOTP prebumer pump 

Flow stall at lower power level in 
prebumer volute discharge vanes 

• Limit orbiter to 67 percent of 
minimum power level 

• Redesign volute vane, vane 
angle, and contour change 

• Screen out one of approximately 
every 20 volutes exhibiting bi- 
stability in green run tests 


i. nruir uconug: 

Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPOTP 

l.f.l 

Turbine bearing inner race 
cracking 

Stress corrosion cracking (SCC) 
initiated from corrosion pit; key 
ingredients for SCC are hoop 
stress and trapped moisture 

• Roughen spacer to between 32 
and 64 surface finish to enhance 
moisture removal 

• Delete heat gun use to minimize 
moisture collection 

• Spacer not bottomed prior to dry 
cycle to enhance spacer/bearing 
gap drying 

• Multiple chills without dry cycle 
not permitted 

• Preheat vacuum dry oven to 1 85 
to 195 °F 

• Initiate vacuum cycle when 
critical hardware temperature is 
within 5° of oven temperature 

• Vacuum cycle extended from 2 
to 3 h to enhance moisture 
removal 


l.f.2 

Delamination of No. 3 bearing 
cage 

Four-lobe nut design tended to 
cause pumping of lox against the 
No. 3 bearing cage 

Turbine bearing nut changed from 
four full-length lobes to two 
shortened lobes; problem 
corrected 

l.f.3 

Bearing No. 4 wearing more than 
bearing No. 3 

Uneven load on the bearings 
and/or unequal cooling and/or 
unloading 

Turbine bearing cartridge 
enlarged; problem of uneven wear 
improved but not solved 

l.f.4 

Bearing No. 2 wearing more than 
bearing No. 1 

Uneven load on the bearings 

Pump bearing isolator enlarged; 
even loading of bearings was not 
accomplished, therefore, change 
did not help uneven bearing wear; 
unincorporated solutions; 
hydrostatic bearing, silicon nitride 
balls 


l.f.5 

Uneven wear of ball bearings 
between bearings No. 1 and 2, and 
between bearings No. 3 and 4 

Uneven load on the bearings 

Prebumer pump bearing isolator 
and turbine bearing cartridge have 
had their deadband increased; 
deadband is the space between the 
outer race and the isolator and 
cartridge; the greater the space, the 
more movement before the load is 
transferred to the isolator and 
cartridge; in general, the turbine 
end bearings No. 3 and No. 4 
improved; little change in the 
uneven wear between the No. 1 
and No. 2 bearings 


193 

















Table A-6. Turbomachinery problems (continued). 


f. HPOTP bearings (continued) 


Component 

No. 

Problem 

Problem Cause 

HPOTP 

l.f.6 

PBP ball bearings (No. 1 and No. 
2) experienced spalling 

In-housing rotor balancing with 
inadequate lubrication/cooling 

Sept. 1977 

l.f.7 

Bearing number 3 failure (incident 

No. 3) 

Excessive coolant flow forces in 
the prebumer pump end bearings 
unloaded the No. 1 bearing, 
allowing high radial motion; the 
excessive pump end radial motion 
increased the turbine end 
overhung rotor deflections; 
unequal load sharing of the turbine 
end bearings (No. 3 with most of 
the load) combined with the high 
synchronous rotor deflections 
degraded the turbine bearings, 
allowed rubbing and ignition 

June 1989 

l.f.8 

Prebumer pump bearing failure 
(incident No. 33) 

HPOTP PBP excessive ball wear 
and failure of high time bearings; 
bearing heat generation escalates 
cage degradation and breakup; 
cage particles block coolant exit, 
causing pressure buildup and 
asymmetric coolant flow; high- 
velocity particles impact and 
ignite on the inducer, large gas 
volume in inducer and impeller 
area allows rapid speed increase; 
turbine overspeed causes first- 
stage disk failure 

g. HPFTP bearings 

Component 

No. 

Problem 

Problem Cause 

HPFTP 
July 1989 

1-8-1 

Bearing cage cracks 

Six cage fractures to date; cracks 
are discovered during normal 
recycle; test history indicates 
cracks related to total time 

May 1991 

l.g.2 

Missing chrome on turbine 
bearing carrier at the No. 4 
bearing location 

Heavy spinning of No. 4 bearing 
outer race caused by ball/race 
friction, cage/race friction, and 
bearing loads 


Problem Solutions 

Thermal growth of ball bearings 
caused balls to expand to the point 
of detrimental rubbing with the 
race; the inner race diametral 
bearing clearance was increased in 
conjunction with elongated cage 
pockets; eliminated in-housing 
rotor balancing; PBP bearing 
springs between bearings No. 1 
and No. 2 were softened to reduce 
the axial load on the bearings 
(bearing preload); the bearings no 
longer spall, but bearing wear has 
increased 

• Decreased the bearing coolant 
forces-pump and turbine 

• Added turbine end bearing 
coolant jet ring 

• Increased bearing preload 

• Redesigned isolator and 
cartridge 

• Improved balance 


The block I modification of this 
turbopump was unique; the design 
modification was intended to 
reduce bearing wear and is not a 
flight design 


Problem Solutions 

Experience with fractured cages is 
benign; demonstrated factor of 2 
in excess of 2,500 s; life limited 
bearing to 2,000 s; cage was 
thickened on 10 K pump 

10 K pumps with the FEP bearings 
provide a reduced driving force 
for outer race spinning; no 
dynamic signature related to 
wear/loss of chrome; no 
anomalous bearing ball and 
raceway conditions resulted from 
loss of chrome or preload spring 
wear 
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Table A-6. Turbomachinery problems (continued). 


h. 


Other HPOTP cracks 


Component 


No. 


Problem 


Problem Cause 


HPOTP 


l.h.l 


Cracks in the second-stage nozzle, 
which extend beyond the 
acceptable region of the inner 
shroud relief grooves 


Axial cracks are attributed to low- 
cycle thermal fatigue damage 
produced by thermal strains during 
engine startup and shutdown 
transients; aggravated by casting 
microporosity/shrinkage 


l.h.2 


Cracking cup washers 


Previous cup washer material 
specification was on the sheet 
metal material from which the 
washers were formed; cold 
working of material resulted in 
high hardness and low ductility, 
predisposing washers to cracking 


l.h.3 


First-stage turbine disk coolant jet 
ring S tubes cracking 


High-cycle fatigue 


l.h.4 


l.h.5 


Hydrogen leak allowed by 0.25-in Class II plug weld is susceptible to 
crack in housing coolant plug shrinkage cracks 

weld No. 1 1 


Balance piston cavity pressure 
port welds 


Lack of fusion or incomplete 
penetration in class II fillet welds, 
Nos. 22 and 24, of the balance 
piston; existing NDI could not 
detect root side or imbedded 
critical size HCF flaws 


l.h.6 


Housing seal groove fillet 
cracking 


Low-cycle fatigue 


l.h.7 


Diffuser vane cracks 


Main impeller blade wake 
dynamic loading plus high mean 
stress caused high-cycle fatigue 
cracks at leading edge of vanes 


l.h.8 


Main housing drain “T” fitting 
leaks 


Stringers in fitting material 
(CRES) 


l.h.9 


Main housing microfissures 


Casting process caused surface 
microfissures; core reaction 


l.h.10 


Jet ring cup washer high-cycle 
fatigue cracks 


Flow environment caused high 
(40 kHz) frequency high-cycle 
fatigue cracks 


Problem Solutions 


The cracks are controlled by 
visual inspection at each 
disassembly; all cracks outside the 
relief groove area are evaluated by 
MR; life limited by DAR; hipping 
(hot isostatic pressing) of casting 
to reduce microshrinkage 

ECP written to define the material 
properties on the shaped form 


S tube material changed from 347 
CRES to A286 stainless steel; 
A286 has increased fatigue 
resistance, solving the problem 

All HPOTP’s are leak tested prior 
to flight 


Use as is; these welds are tolerant 
to large defects; soap bubble and 
mass spectrometer inspection done 
after every acceptance test 


Problem determined to be 
acceptable via fracture mechanics; 
flaw will not propagate past a 
shallow residual stress depth 

Improved loading path by cutting 
back the leading edge of the 
diffuser vanes 0.10 in; 
reconfigured grooves adjacent to 
vane passageway; shotpeen 
leading edge area of vane after 
proof test 

Changed fitting material from 
CRES to Inconel 718™; leak 
check CRES fittings postflight 

Life limited to 1 1 ,024 s by DAR; 
improved process to eliminate 
core reaction 


Life limited by DAR; redesign 
TBD 
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Table A-6. Turbomachinery problems (continued). 


i. Other HPFTP cracks 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPFTP 
May 1979 to 
present 

l.i.l 

First-/second-stage turbine nozzle 
cracks; cracks are on leading 
edges of vanes and inner and outer 
shrouds; cracks initiate at low and 
high time 

Low-cycle fatigue caused by 
thermal transient start 

Modified start sequence to reduce 
thermal transients; cracks are 
shallow and monitored by 
borescope and dye penetrant 
inspections 

March 1985 

l.i.2 

Bellows shield cracking 

Failures not function of starts, 
time, or power level 

Designed a short tip bellows 
shield; vastly reduced occurrence 
of cracking 

July 1985 

l.i.3 

First-/second- stage impeller 
indentations; 30-mil deep cracks 
predominantly in axial direction; 
cracks observed in all three 
indentations in or around galled 
areas; 15 indentation depth, two 
sets of indentations, three 
indentations per set 

Indentations created by pounding 
type contact and rubbing between 
impeller inner diameter and the tie 
bolt lobes; relative contact that 
caused localized heating 
accompanied by high-strain levels 
to form microstructurally changed 
material susceptible to crack 
initiation and propagation 

Redesigned impellers 

July 1989 

Li.4 

First-stage tip seal/housing lug 
fractures 

High mean stresses in both 
housing lugs and tip seal lip; stress 
is induced by housing distortion; 
there is sufficiently high dynamic 
stresses for high-cycle fatigue 
failure 

Redesign first-stage tip seal lip at 
three locations to remove effects 
of housing distortion; existing 
hardware was to be reworked; the 
redesign eliminated static load on 
housing lugs, reduced mean stress 
in tip seal lip, distributed pressure 
load to ends of tip seal, increased 
alternating stress capability by a 
factor of 4, and smoothed 
scalloped shape of tip seal 

August 1989 

I.i.5 

Second-stage diffuser pilot lip 
crack; circumferential cracks up to 
7-in long; interstage seal wear 
typical on units with cracked 
diffusers 

All eight cases due to out-of-print 
diffuser or housing; diametral 
interference of 0.0187 to 0.0297 in 

Document housing and diffuser 
diameters prior to assembly; 
increased groove radius; a pilot lip 
fragment would be contained 
during hot fire testing; prior flight 
experience with cracked diffuser 
was benign 

September 1989 

l.i. 6 

Center body casting to pump end 
housing forging weld 59 
indications; x-ray indications 
show up as shadowlines and radial 
indications; concern for joint 
integrity because of x-ray 
indications and, shadowline 
masking of defects 

Defects result from welding 
difficulties 

Analytical results and inspection 
requirements assure flight safety; 
welding speed slowed from 30 to 
20 in per minute for new housings 


Li. 7 

Turbine support welds 16 and 17 
flaws 

Penetrant indications are 
frequently observed at these welds 
after normal machining or thermal 
processes, this problem was 
designated a producibility item 

Fracture mechanics analysis was 
conducted to develop a criteria for 
acceptable flaw sizes; low-stress 
machining was employed; weld 
surfaces are polished to remove 
flaws prior to etch and pent; the 
preparation for weld 1 7 was 
modified to improve accessibility 
when making the weld 

September 1990 

Li. 8 

Titanium inlet sheet metal weld 
offsets; initial HCF analysis 
showed many offset conditions to 
be unacceptable 

Weld offsets are caused by 
difficulty in the welding process 

More detailed analysis was started 
to eliminate conservatisms; for 
this purpose, more hot-fire strain 
gauge data were obtained, 
laboratory testing to determine 
bending/membrane splits was 
conducted, and a fine mesh finite 
element model was used for 
calculating mean stresses 


196 









































Table A-6. Turbomachinery problems (continued). 


1. WUICI 1111 11 Wl< 

Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPFTP 
March 1985 

l.i.9 

First-stage impeller front shroud 
crack; high-cycle fatigue crack 
initiated at impeller shroud O.D.; 
initiation occurs at site having 
adverse surface conditions (comer 
break and surface finish) 

Impeller diametral mode 
resonance with first-stage diffuser 
vanes; most probable impeller 
response mode identified by 
modal tests and structural 
dynamics analysis; mode 
characterized at 1 2 mod 3 mode; 
this occurs in the 32,000 to 32,600 
r/min range; and it requires 
interaction with diffuser vanes 

Initially, the operation at the most 
probable response mode was 
limited to 160 s in the 32,000 to 
32,600 r/min range; improved 
control of diffuser vane 
dimensions; also, improved 
surface finish and shroud comer 
break control; increased shroud 
comer radius allowed for 
increased DAR limits 

February 1991 

1 .1.10 

Housing HCF life; discharge 
volute welds 223 and 228 HCF 
predicted life based upon limited 
hot-fire strain gauge data and 
worst-case drawing geometry is 
less than the CEI 

Several housings held with weld 
discrepancies during fabrication 
cycle; similar weld mismatches 
have been observed in old and 
new housings 

Flight based on single flight 
reliability; analysis underway to 
determine mean and alternating 
stress to calculate life; 3-D FEM 
submodel parametric model to 
account for offset and radius of 
volute 

August 1980 to 
present 

l.i.ll 

Thrust ball cracks 

Cracks found on the ball wear 
tracks indicate high metal 
temperatures and thermal 
gradients; rubbing between ball 
and insert causes localized heating 
during contact 

By analysis, high-surface tensile 
stresses predicted; cracking 
relieves residual and/or thermal 
stresses; moly lube added to thrust 
ball to reduce friction; thrust ball 
inspected after every test; cracked 
balls are replaced 

December 1991 

l.i.12 

Second-stage KEL-F support pilot 
lip crack; visual inspection 
detected crack in radius at 
pilot/support interface 

Two occurrences of support pilot 
fracture in program; first fracture 
at large pilot and second at small 
pilot; high-cycle fatigue 
propagation; first fracture due to 
out-of-print condition; second 
fracture still undetermined 

Changed requirements for 
repairing KEL-F supports; defects 
deeper than 0.20 in and cracks are 
rejected; monitored by DAR 
inspection limit 

January 1992 

l.i. 13 

HPFTP housing inner ring 
cracking type A (through) cracks 
through the bolt holes common to 
all units 

Low-cycle fatigue caused by 
punch loads from discharge struts 
and aggravated by hot gas leaking 
into the coolant circuit 

DAR 1 1 99 requires a complete 
bolt hole inspection at each 
turbine disassembly and at 20 
starts and even 10 starts thereafter; 
the interval drops to 5 starts if 
crack conditions are severe 
enough 

October 1981 to 
present 

l.i.14 

HPFTP turbine support sheet 
metal fragments; dislodged 
fragment of inlet sheet metal 
detected during posttest 
inspection; second occurrence on 
same unit 

Crack initiation and propagation 
by high-cycle fatigue 

All HPFTP’ s are inspected after 
every hot-fire test for any out-of- 
specification cracks; new 
inspection requirements; DAR 
limits sheet metal to 4,250 s 

March 1992 

l.i. 15 

Weld 56 turnaround duct weld 
crack 

Crack initiation and propagation 
by high-cycle fatigue 

Added infield inspection and DAR 
that life limited the weld to 
13,600 s 

July 1992 

Li. 16 

HPFTP main housing bellow 
crack; investigation of source of 
Haynes 1 88 in engine revealed 
cracks and missing fragments 
from main housing bellow 

Only one occurrence observed on 
current configuration; bellows 
manufactured with thin wall 

New units correctly machined 

June 1990 

Li. 17 

LPFTP second-stage rotor crack in 
outer shroud; cracked rotor is fleet 
leader for time and fifth fleet 
leader for starts; unit No. 82106 

High-cycle fatigue failure 

DAR 2431 limits life to 15,000 s 
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Table A-6. Turbomachinery problems (continued). 


j. HPOTP Other 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPOTP 
July 1978 

l.j.i 

Capacitance probe failure 
(incident No. 9) 

Contact of the capacitance probe 
plates with the pump shaft speed 
nut; the resulting frictional heating 
and abrasion of metallic particles 
in a lox environment caused 
ignition 

Removed capacitance probe 

March 1977 

l.j.2 

Primary lox seal failure (incident 
No. 1) 

Ignition in seal package area; most 
likely the result of primary seal 
bellows failure 

• Redesign seal package 

• Increased barrier pressure lower 
redline from 75 lb/in 2 gauge to 

1 70 lb/in 2 absolute 

• Instituted HPOTP secondary seal 
cavity pressure redline of 100 
Ib/in 2 absolute maximum 


1 j 3 

Turbine to prebumer interface 
leakage failure effects 

HPOTP eccentric ring damage 
during pump installation 

New single-piece design 
implemented on all pumps to 
reduce chance of crushing the ring 


k. HPFTP Other 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

HPFTP 

l.k.l 

Axial and radial rubbing of the 
first-stage turbine blade tip seal 

Problem not accounted for in 
original design 

Reconfigured to eliminate axial 
and radial rubbing 


l.k.2 

Axial rubbing between the second- 
stage disk and turbine interstage 
seal 

Insufficient clearances between 
turbine interstage seal/second- 
stage fishmouth seal and second- 
stage disk/forward blade platform 

Increased the clearances between 
the turbine interstage seal/second- 
stage fishmouth seal and second- 
stage disk/forward blade platform 


l.k.3 

Thin sheet metal bulging of inner 
and outer shrouds 

Insufficient original design 

Increased the sheet melt thickness 
to eliminate bulging 



Pressure losses in the turnaround 
duct portion of the FMOF HPFTP 
turbine 

Phase I HPT did not eliminate 
pressure losses; phase II had high 
turbine temperatures and 
transverse delta pressure 

Reverted back to FMOF inner and 
outer shroud of turnaround duct, 
but with thicker sheet metal in 
diffuser section, to reduce high 
turbine temperatures and 
transverse delta pressure 


l.k.5 

High turbine temperatures and 
reduced pump efficiency 

Metal impeller labyrinth seal 

Changed from metal impeller 
layby seal to Kel-F seal; the Kel-F 
seals contributed to reducing the 
turbine temperatures and 
improving pump efficiency 

February 1984 

l.k.6 

Coolant liner buckling failure; 
engine 0108 (incident No. 28) 

Coolant liner cavity overpressure 
due to excessive hydrogen flow 
past the lift-off seal into the liner 
caused coolant liner buckling and 
subsequent collapse of the 
turnaround duct 

Redesign to eliminate excessive 
seal leakage; redesign to eliminate 
interstage seal axial rubbing; 
coolant liner pressure redline 
incorporated; acceptance criteria 
developed for coolant liner 
temperature and pressure 

October 1981 

l.k.7 

Turnaround duct failure (incident 
No. 23) 

High-cycle fatigue cracking of 
weld 56 due to lack of weld 
penetration 

Weld joint redesigned to provide 
better weld penetration 

August 1989 

l.k.8 

KEL-F seal intemal/extemal Kel- 
F melting, T-lock damage, support 
fretting, antirotation pin damage, 
nut lock damage, and loss of 
preload on tapir nut 

Relative motion between details; 
internal melting (because of its 
possibility of generating large 
pieces) is most critical; internal 
melting is believed to be due to 
vibrations below 1 2 kHz 

Seal redesign; improved 
bottoming procedure has 
eliminated support fretting and 
anti rotation pin damage; increase 
torque on retaining nuts 
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Table A-6. Turbomachinery problems (continued). 


k. HPFTP Other (continued) 
Component 1 No F 


December 1991 


HPFTP 
April 1982 


HPFTP 

November 1989 


March 1990 


Problem 


1 2 kHz vibration; most return to 
flight units exhibited this 
phenomenon 



Kaiser hat nut failure (incident No. 
25) 



LPFTP housing galvanic corrosion 


LPFTP 330 Hz phenomena; 
LPFTP 4006 exhibited a strong 
330-Hz phenomena that reached a 
maximum amplitude of 
approximately 6 g; several units 
have had amplitudes in excess of 

5g 


Problem Cause 


It is believed that the source of 
12 kHz may be from the main 
housing volute liner vent hole 
diameters (01/93) 


The Kaiser hat nut redesign 
provided a hot gas leak path to the 
Kaiser hat, resulting thermal 
stresses led to fatigue failure of the 
hat; the hat failure allowed hot gas 
flow into the turbine bearing 
coolant, which failed the bearing; 
this was the first test of a new 
Kaiser hat nut redesign 


Galvanic corrosion under copper 
due to fluids entrapped during 
plating; attributed to moisture 
cryopumped during ground test; 
moisture provides electrolyte for 
galvanic action between dissimilar 
metals; significant corrosion is 
averted if flight occurs within 1 
year of the initial ground test 


Believed to be caused by incipient 
alternate blade cavitation 


Problem Solutions 


Flying based on margin 
demonstrated by unit 2027; 
continued margin testing on units 
2127 and 2227; develop a method 
of quantifying damage and flight 
acceptance criteria 


• Redesign Kaiser hat nut to 
eliminate leak path 

• Decrease ASI jet impingement 
temperature on nut 


Inspection of LPFTP volute based 
on hot fire time and time between 
potential moisture introduction 
and first flight; vacuum dry 
instituted after ground test to 
remove moisture 


Considered as a benign condition 
because of ground test history 
beginning with first fuel vent and 
continuing through two units 
greater than CEI life, flight history 
beginning with STS-1, 
development tests with special 
instrumentation, and pump 
disassembly results 


1. Lox Alternate Turbopum 


Component 


Lox Pump 



No. 

Problem 

1 . 1.1 

Pump inlet housing vane leading 
edge cracking 

1.1.2 

Bellows shield buckling 

1.1.3 

Turbine turnaround duct cracking 
on vanes in fillet 

1.1.4 

Turbine inlet housing dome cracks 

1.1.5 

Turbine inlet housing cracks in 
core breakout region of struts 

1.1.6 

Inducer fatigue crack near fillet 
between blade and hub; failure on 
unit 7-1G 


Problem Cause 


Subsurface porosity breaking 
through during operation 


Delta pressure across shield, 
insufficient venting 


High-hoop strain caused by 
thermal gradient at shutdown 


Higher than expected temperature 
on dome (2,200 *F), high thermal 
strain 


High stress concentration caused 
by tight fillet radius and rough 
casting surface 


Blade rub on O.D., due to tight 
clearance and high vibration 


Problem Solutions 


Improved casting technique 


Vent holes added 


• Remove vanes 

• Slot inner flow wall 


Redesign, dome is now separate 
piece from inlet housing (hubcap 
design); change dome material 
from Inconel 718™ to Haynes 
230™ 


Casting redesign, added material 
so hollow core does not break 
through, holes drilled instead 


• Eliminated vibration problem 

• Open OD. clearance from 10 to 
29 mils 
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Table A-6. Turbomachinery problems (continued). 


1. Lox Alternate Turbopump 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

Lox Pump 
(cont.) 

1.1.7 

Bellows failure through crack 
initiated at bolt attachment 

Stress concentration from bolt 
locking key was oriented in worse 
location; slot was undersized (not 
to print) high stress induced 
during key installation due to 
interference 

• Slots moved 90° 

• Slot size is now controlled 

• Reduced fit between bellows and 
turbine outer vane support 


1.1.8 

SSME turning vane fatigue cracks 
when ATD HPOTP utilized 

ATD turbine discharge directs 
more hot gas on vane than current 
SSME HPOTP; flow-induced 
vibrations cause cracking 

In work (two options) 

• Redesign ATD turnaround duct 
geometry to direct flow similar to 
current SSME pump 

• Strengthen turning vane, increase 
vane thickness, or change material 


■ 

Pump end ball bearing life below 
prediction, heavy wear on inner 
race, cage, and balls 

Loss of lubrication 

• Changed ball material to silicon 
nitride 

• The bearing health was improved 
by inner race cooling and outer 
race guided cage 


1.1.10 

Step increases in synchronous 
vibration levels 

Instability of the inducer and 
shroud clearance aggravated by 
cavitation loads 

Increased inducer tip clearance (29 
mil); improved damping seal 


m. Fuel Alternate Turbopump 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

Fuel Pump 

l.m.l 

Lift-off seal cracking during initial 
pressure test 

High bending stress in first 
convolute 

• Change taper in convolution 
region 

• Material change, went from 
Berylco to MP35N 


l.m.2 

Pump discharge housing cracks on 
trailing edge of splitter vanes 

3-percent strain on trailing edge, 
displacement-driven problem; 
original P&W finite element 
model had loads applied in wrong 
direction 

• Increase housing wall thickness 

♦ Add stiffener ribs 

* Cut back trailing edge 

• Add dual splitter 


l.m.3 

Diffuser cracking around orifice 
hole 

High stress concentration due to 
sharp edge 

• Increase radius 

• Improve casting technique 


1 .m.4 

Turbine inlet cracks on inner 
shroud trailing edge 

High strain during startup transient 
due to thermals 

• Slotted shroud, eliminated hoop 
continuity 

• Changed interference fits 


l.m.5 

Turbine housing/discharge 
housing bolt cracking 

High temperature on bolt head due 
to recirculation of hot gas 

• Add additional cooling to the 
cavity 

• Reduce recirculation with flow 
blocker 
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Table A-7. Rotordynamic problems. 


Element/Subsystem 

Problem 

Problem Cause 

Problem Solutions 

Rocketdyne HPFTP 

Subsynchronous vibration 

Rotordynamic instability-rotor 
supported on smooth seals will 
exhibit subsynchronous self- 
excited whirl when the speed 
approaches twice the first natural 
frequency 

Damping seals reduce the 
destabilizing cross-coupled forces 
and allow stable operation beyond 
twice the first natural frequency 

Rocketdyne HPOTP 

Subsynchronous vibration 

Rotordynamic instability-rotor 
whirled at 90 percent of shaft 
speed due to destabilizing forces 
generated by slipping spline 

Splines were piloted to prevent 
slippage and damping seals were 
incorporated to supply stiffness 
and damping 

Rocketdyne HPFTP 

A 175-Hz subsynchronous whirl 
limited pump speed to 22,000 
r/min 

Rotordynamic instability 

Bearing carriers were stiffened 
after coulomb friction devices 
proved unsuccessful; further 
stiffening was achieved by 
replacing two major labyrinth 
seals with two smooth seals 
between the three pump impellers; 
this raised the whirl frequency 
from 175 to 300 Hz without being 
eliminated 

ATD HPOTP 

High-synchronous vibration 

Hydrodynamics excitation 
resonance 

Redesigned inducer 

ATD HPFTP 

Alpha vibration 

Hydro possibly 

Not solved 

Simplex pump 

Critical speed in the operating 
range (analytical) 


Lengthened bearing span, 
lightened inducer, reduced 
overhang 


Table A-8. Combustion devices. 


2. Combustion Devices 


a. Main Combustion Chamber ■ 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

MCC 

2.a.l 

Delamination of EDNi/Narloy-Z 
bondline; typically located on 
MCC aft end 

Attributed to two different 
operations in the plating process: 

(1) High copper levels in the 
cathodic activation process 

(2) Mercury contamination during 
EDNi process 

* Improved process to remove 
copper and other metallics for the 
bath; established requirements that 
allow only 25 percent of the 
previous allowed metallic 
contaminants 

• Mercury was entering the tank 
through the tooling used to rotate 
the part; all the mercury has been 
removed from the tooling and 
replaced by copper brushes 


2. a. 2 

EDNi material properties do not 
meet specifications; yield strength 
is below the specification 
minimum 

Inadequate control and definition 
of processing variables; lack of 
proper process monitoring 
techniques, changes in raw 
material, and general 
contamination 

A comprehensive set of CPI and 
Taguchi experiments were 
conducted to define the major 
process control factors; limits have 
been established for these factors 
and are being tightly controlled; 
an automated process control 
system has been installed; a class I 
ECP was processed to better 
define the process, including the 
accept/reject; final acceptance of 
EDNi properties is determined by 
a specimen from excess stock on 
aft end j 
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Table A-8. Combustion devices (continued). 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

MCC (cont.) 

2.a.3 

Inlet welds 4 and 5 do not meet 
CEI requirements when minimum 
wall thickness and maximum 
allowable drawing mismatch are 
considered 

Conflicting tolerances; 
manufacturing can make part 
within specifications, but certain 
combinations of thickness and 
offset prevent NCF CEI life to be 
shown by analysis 

An additional requirement was 
added to determine if units meet 
CEI life requirements or to 
determine the allowable life; this 
was done using analysis, pull test 
strain data, hot-fire strain data, or 
surface contour data; this problem 
points to the need to do sensitivity 
studies in the design phase 


2.a.4 

Liner life analysis methodology 
does not predict the observed 
midchannel failure location 

Current analysis methods are not 
capable of modeling the failure of 
a hot gas wall of a MCC liner 



2.a.5 

Pin hole leak in weld joint 12 
detected during postflight leak 
check of STS-26 

X ray was able to identify lack of 
fusion in weld joint 12 

MCC unit 4001 was repaired by 
grind-out and weld fill; bondline 
was not impacted; large throat 
MCC configuration modifies 
parent and weld material of welds 
10, 11, 12, 13, and 14 


2.a.6 

Two-duct hot-gas manifold MCC 
erosion; overheating of hot-gas 
well causes pinholes, cracks, and 
dog-housing; extent of damage 
exceeds that experienced by 
higher time units 

Many factors contributed to the 
accelerated erosion of MCC hot- 
gas wall; the primary cause has 
been attributed to an increased 
amount of hot-gas ingestion into 
the main injector coolant plenum; 
other contributing factors include 
lox post underbiasing and high 
resistance MCC’s 

Redesigned main injector 
flowshields have been 
incorporated into the phase 11+ 
engines to decrease the amount of 
hot-gas ingestion; other changes 
included increasing the lox post 
biasing requirements and 
incorporating a revised CCV 
schedule to increase the MCC 
coolant flowrate at RPL and 1 04- 
percent power level; additionally, 
a new method of calculating the 
MCC flowrate was developed 


2.a.7 

Burst diaphragm failures on 
engines 2015 and 2107 

The presence of the silicone 
elastomer on the diaphragm cap is 
required to dampen the vibration 
during engine operation; 
diaphragms with improperly 
bonded elastomer are subject to 
failing at the coined groove 
intersections due to operational 
vibrations; the unbonded 
elastomer that was evident on 
these parts is suspected of 
reducing the damping effect that 
allows for vibration and premature 
failure of the diaphragm at the 
coined grooves 

The elastomer application process 
has been changed to improve the 
bonding characteristics; because 
bond failures usually result from 
poor surface cleanliness, a solvent 
rinse has been added prior to 
applying the silicone primer; the 
primer cure has also been changed 
to room temperature rather than 
the previous forced-air circulating 
oven cure and the elastomer is 
vacuum processed prior to being 
injected into the burst diaphragm 
cap; improved bonding has been 
demonstrated in the lab when parts 
were processed with the modified 
application process 

July 1980 

2.a.8 

MCC lee jet failure resulting in 
incorrect chamber pressure 
reading (incident No. 18) 

The lee jet retainer ring was 
installed improperly; CH A PC 
failure resulted from a PC sense 
port purge lee jet becoming 
dislodged and exposing the sensor 
to the MCC coolant discharge 
pressure 

• Implemented shutdown for 
“major component failure” prior to 
SRB ignition during ground 
testing 

• Redesigned lee jet retention 
device to prevent dislodgment 

• Added HPOTP turbine discharge 
temperature lower red line 


2.a.9 

Weld offsets 

General problem with weld offsets 
due to difficulty in welding 
sections with thin walls 

Improve welding process; design 
should be robust with respect to 
weld offsets 
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Table A-8. Combustion devices (continued). 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

MCC (cont.) 
March 1985 

2.a.l0 

Outlet manifold weld cracks 
(incident No. 30) 

Undetected flaw in outlet manifold 
neck; an external leak developed; 
see document RSS-8595-39 

Near-term solution was to 
reinspect MCC’s to verify no 
CIFS, reduce the life by one half 
and to reinforce outlet with EdNi; 
the long-term solution was to go to 
a single piece forging 


b. Nozzle 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

Nozzle 

November 1979 

2.b.l 

Nozzle steerhom failure (incident 
No. 15) 

The fracture of the steerhom was 
caused by the use of improper 
weld wire in the welds on either 
side of the T-joint; the joint failed 
at the time of maximum strain 
during shutdown 

• Modify weld wire process 

• EdNi plate nozzles in the field 
with wrong weld wire 

• Initiate nozzle lab testing 
considering static and dynamic 
loads to verify math models; 
incorporate new steam loop design 

May 1979 

2.b.2 

Nozzle steerhom failure (incident 
No. 13) 

Low-cycle fatigue associated with 
the 200 to 400 Hz oscillations in 
the start and shutdown transients; 
oscillations were unknown at the 
time of the failure 

• Add strain gauge instrumentation 
to better define the start and cutoff 
oscillations 

• Redesign steerhom duct with the 
capability to withstand newly 
identified loads; increased the wall 
thickness from 0.049 to 0.080 in; 
support the steerhom at the No. 9 
hatband and include an expansion 
loop in the downcomer 

June 1982 to 
April 1984 

2.b.3 

Aft manifold thermal protection 
burned up on reentry (STS-4, 6, 8, 
9, 1 1); no nozzle structural 
damage 

During reentry, a shock attached 
to the nozzle blunt body (aft 
manifold lip, causing high 
stagnation temperatures resulting 
in TPS melting 

TPS redesigned to eliminate blunt 
body at aft manifold 

January 1991 


Aft manifold slam holes cracked 
as a result of low-cycle fatigue; no 
effect on engine function or 
performance 

Engines start and shutdown 
transient loads (due to flow 
separation) in combination with 
the slam hole Kt produced fatigue 
at the hole ligament 

Fatigue arrestor bolts were 
designed and implemented to 
extend the life of the slam holes to 
CEI requirements; these bolts 
eliminate the Kt during the 
compression cycle of the loading 

September 1988 


G 1 5 seal overheated and cracked 
(stress rupture) during STS-26 

The seal heating is a result of hot 
gas flow being driven into the 
joint by nozzle coolant tube 
protrusion into the hot-gas flow, 
ovalness of the tube bundle and 
gaps between the MCC and the 
coolant tubes 

• A flow recirculation inhibitor 
was designed and implemented to 
preclude hot gas from reaching the 
seal 

• Limits on tube protrusion and 
gap were established 

May 1992 

2.b.6 

Nozzle fatigue cracks in stubout 
fillet radius 

Fractography confirms transient 
fatigue mechanism as a result of 
transient loading and fillet radius 
stress concentration 

Life limit nozzles to 18 transients, 
which is 50 percent of 36 
transients (when the first crack 
initiation occurred) 


■ 

Nozzle stubout weld indications 

Welding process insufficient to 
eliminate the existence of porosity 
in pores with tails 

Life limit nozzles based on 
severity of porosity found 

1982 to present 

2.b.8 

Coolant tube fatigue 

High strains during start and sea- 
level shutdown transients 

Criteria established for allowable 
leakage limits; permits class I and 
II leakage on hot and cold walls; 
class III and higher leaks are 
unacceptable and require repair 
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Table A-8. Combustion devices (continued). 


b. Nozzle (continued) 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

1984 to present 

2.b.9 

Coolant tube corrosion 

Contamination seeds and sustains 
corrosion 

Fabrication process improved to 
minimize residual contaminants; 
no leakage permitted on coldwall 
side; minor leakage (CL I) 
permitted on hotwall; 
unacceptable leaks are repaired 

May 1993 

2.b.l0 

Feedline elbow bracketed welds 

Welds with incomplete 
penetration developed fatigue 
cracking during start and sea-level 
shutdown transients 

Life limit established at 22 
unrestrained transients with an 
inspection required at 1 1; welds 
reworked to extend life 

July 1993 

■ 

Stubout weld defect 

Fatigue growth in a weld defect 
(lack of fusion) while under start 
and sea-level transients 

Life limited by generic stubout 
DAR at 27 total transients with an 
inspection required at 3 8 
unrestrained transients 


c. Powerhead 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

Powerhead 


Fatigue of lox post creates leaks 
and destroys engine powerhead 
through lox hydrogen fire 

Hot-gas H2 flow creates vortex 
shedding coupled with large static 
load 

• Initial solution; installation of 
flow shields on outside posts, two 
posts per shield 

• Two-duct hot-gas manifold 

• Super posts tested but not 
incorporated 


■ 

Crack initiation and propagation in 
powerhead G6 flange; potential 
hot-gas leakage across G6 seal 

Low-cycle fatigue failure due to 
high strain caused by flange roll 
and high HPFTP turbine discharge 
temperatures; only two 
powerheads with >85 ms starts 

• TBD 

• High start units in test will be 
inspected at approximately 80 
starts 


2.c.3 

Powerhead coolant duct welds 
have excessive mismatch and did 
not meet CEI life requirements 

Baseline design deficiency; 
fabrication of welds difficult; wall 
thickness too thin 

• Utilize inner guide ring to 
minimize offset on later phase II 
ducts 

• Increase the thickness locally in 
the area of the weld joint on phase 
11+ ducts 


I 

Main injector oxidizer inlet 
manifold base ring welds do not 
meet CEI requirements; 
specifically welds 6, 7, 16, 17, 52, 
and 53 

Analysis assumes all worst-case 
geometries, i.e., maximum offset, 
minimum wall thickness, material 
properties not well defined; design 
deficiency and fabrication 
difficulty 

Actual geometries measured for 
weld joints 6, 7, 52, and 53 and 
materials test program done; weld 
joint 16 blended, 17 tracked by 
DAR; newer powerheads have 
forged tees so welds 1 6 and 1 7 
meet CEI; robotic welding 
improved fabrication 



FPB liner tab failure on engine 
2206 

Manufacturing error; weld 
extended into radius, pump impact 
during installation 

Considered unique 



Oxidizer prebumer “POP’s,” 
which cause interpropellant plate 
deformation and potential braze 
joint damage 

Comingling and combustion of 
hydrogen and oxygen in prebumer 
lox dome due to aspiration effects 
during transients 

Flatness check of faceplate is 
required if a “POP” occurs above 
a specified “g” level; changed start 
and shutdown sequence to reduce 
occurrence 

March 1978 
June 1978 
July 1980 


Main injector lox post thread/tip 
failures (same as item 2.c. 1 ) 
(incident Nos. 6, 7, and 17) 

High-cycle fatigue failure due to 
large fluctuating pressure loading 
and large static load 

Replace CRES post tips with 
Haynes tips 

July 1981 
September 1981 

2.C.8 

Main injector lox post inertia weld 
failure (same as 2.c.2) (incident 
Nos. 20 and 21) 

High-cycle fatigue failure due to 
large fluctuating pressure loading 
and large static load 

Replace CRES posts with Haynes 
posts 
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Table A-8. Combustion devices (continued). 


c. Powerhead (continued) 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 


2.C.9 

Main injector interpropellant plate 
cracking 

High thermal gradient across the 
interpropellant plate and hydrogen 
charging of the hot-gas surface 
causes thermal cracking 

Improved the heat shield retention 
system to eliminate heat shield 
damage and accepted the thermal 
cracked as a benign self-limiting 
condition 


2.C.10 

Main injector lox post stub life 

Fatigue life limited based on 
correlation to interpropellant plate 
cracking 

Generic DAR based on single 
flight reliability and elliptical 
radius incorporated in 1987 to 
reduce stress concentration factor 

July 1987 

2.C.11 

Engine 2106 OPB interpropellant 
baffle pin braze joint failure 
(incident No. 31) 

Poor braze quality on units that 
were brazed in ME&T furnace; 
10-percent braze on failed joint; 
ductile overload assisted by LCF 

Verified braze quality on units 
brazed in manufacturing furnace 
to be a minimum of 50 percent 
braze; problem unique to units 
brazed in ME&T furnace; 
improved braze process control 


2.C.12 

Cracking on I.D. of FPB diffuser 

Failures of plug weld No. 3 allows 
diffuser to be internally 
pressurized 

Cracked diffusers are acceptable 
as is; no risk to engine operation, 
weld No. 3 has been modified to 
improve weld penetration 


2.C.13 

Prebumer lox post transformation 
to martensite 

Transformation can be caused by 
material lot variation and/or 
dynamic loading 

Phase II, install support pins or 
deactivate post at higher eddy 
current readings; phase II+, posts 
redesigned and lower dynamic 
loads 


2.C.14 

4,000 Hz vibration on the main 
injector lox inlet splitter vanes 
creates fatigue cracks 

Vortex shedding of splitter due to 
small differences in vane trailing- 
edge geometry, only 20 percent of 
injectors show resonance at 4,000 
Hz 

* Sharpened trailing edge and 
increased open space between 
leading edge of the two splitter 
vanes 

* No 4,000 Hz resonance since fix 
incorporated 

* Gimbal bearing accels added to 
screen 


2.C.15 

Main injector lox post outer 
diameter defects 

Handling and fabrication damage 

Analytically life limited and 
revision to tooling/process 


2.C.16 

Heat exchanger leak detected in 
weld No. 4 bifurcation joint area 

Inclusion in parent material 

Changed material to vimvar to 
eliminate inclusions and 
redesigned to single-coil heat 
exchanger, thus eliminating welds 

February 1984 

2.C.17 

Fuel prebumer manifold boss 
crack (incident No. 29) 

High stress concentration where 
boss is welded to manifold 

Redesigned boss to be integrally 
machined for development 
engines; boss does not exist on 
flight engines 

July 1980 

2.C.18 

Fuel prebumer liner and chamber 
bum through (incident No. 16) 

Injector faceplate deformation 
biased lox element, which caused 
liner erosion; low coolant pressure 
allowed hot gas to contact the 
body wall 

Inspection is done to verify 
element concentricity; divergent 
liner was added to reduce hot gas 
circulation; metering ring was 
redesigned to increase coolant 
pressure; a thermal shield was 
added over the body wall, but later 
removed 

August 1977 

2.C.19 

FPB housing bum through 
(incident No. 2) 

Similar to incident No. 16 
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Table A-8. Combustion devices (continued). 


c. Powerhead (continued) 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 

February 1982 

2.C.20 

FPB fuel injector blockage (ice) 
(incident No. 24) 

Water was introduced into the 
engine during an electrical 
discharge machining process 
performed on the test stand; 
subsequent drying purges 
ineffective; during engine start, 
cold hydrogen caused the residual 
water to freeze; resulting ice 
blocked several FPB fuel element 
inlets, causing a high oxygen to 
fuel ratio and high combustion 
temperatures 

Redesigned boss to be integrally 
machined for development 
engines; boss does not exist on 
flight engines 

January 1981 

2.C.21 

FPB injector lox post failure 
(incident No. 19) 

Metallurgical examination 
revealed all posts to exhibit cold 
work at fillet radius where high- 
cycle fatigue crack was found; 
GH2 flowed into lox post via 
crack and ignited, which eroded 
off lost post tip; damage self limits 
during mainstage, but during 
shutdown, GH2 flows into lox 
dome through damaged element; 
recirculating GH2 ignited with lox 
residual in dome and caused 
remaining element damage 

• Tighter fabrication tolerances 

• FPB lox element support pins 

• OPB eddy current inspections 


2.C.22 

FPB lox post failure 

High dynamic loading due to 
swirling flow caused by misdrilled 
holes 

Tightened control on drilling 
operation, added eddy current 
inspection, and installed support 
pins; phase 11+ element were 
redesigned to reduce stress 

December 1978 

2.C.23 

Heat exchanger coil failure 

Heat exchanger coil leak most 
likely caused by a welding arc 
bum or wall thinning due to 
reaming operation 

• Changed welding procedure 

• Changed reaming procedure 

• Proof test after each HPOTP 
installation 

• Mass spectrometer leak test after 
each proof test and prior to each 
hot fire test 

• Visual examination of heat 
exchanger after every HPOTP 
removal 


2.C.24 

Heat exchanger coil leak detected 
at weld No. 1 

Lack of weld fusion 

Revising welding and inspection 
procedure; designed single tube 
heat exchanger with no weld No. 1 


2.C.25 

Lox inlet seam weld rework 

Mistracking of EB weld of shells; 
unauthorized TIG tack usage on 
the root instead of face, 
contributed to embedded defects 

Short term - shells installed - 
grind groove along length of EB 
weld root side and IVC dye 
penetrant and x ray; shells not 
installed - grind to remove 
defects, TIG weld fill, inspect 
long-term, one-piece shell, no EB 
weld 


2.C.26 

Proof failure of powerhead duct 

Duct not heat treated 

Perform hardness tests on all ducts 
in the fleet; ensure all ducts in 
manufacturing obtain heat treat 


2.C.27 

Liquid metal embrittlement 
(LME) in ASI tube brazing 

Torch braze of sleeve and collar to 
ASI line as it passes through thrust 
cone caused tube to crack and 
braze material to fill crack if 
excessive heat was applied with 
tube restrained 

Lox line borescope inspected after 
torch braze to verify no LME; fuel 
line eliminated braze of sleeve and 
collar and left a 0.040-in gap 
requirement between tube and 
thrust cone 
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Table A-8. Combustion devices (continued). 


Component 

No. 

Problem 

Problem Cause 

Problem Solutions 


2.C.28 

Duct crackipg due to stress 
accelerated grain boundary 
oxidation (sagbo) 

sagbo 

Recommended to not heat pass 
903, but if required to be done 
under ME&T supervision 


2.C.29 

Secondary faceplate retainer 
failures 

High-cycle fatigue failure due to 
high-flow loading 

Short term - Deactivated and 
rodded high flow posts (8, 9, 78, 
and 79); long term - heavy wall 
secondary faceplate retainers 


2.C.30 

FPB ASI line rupture 

Contamination (metallic particle) 
lodged in ASI causing blockage; 
line overpressurized and burst 

Graphite wrap to reinforce ASI 
line 


2.C.31 

AS1 contamination 

Contamination blocked ASI fuel 
inlet, causing prebumer ASI to go 
lox rich, eroding face plate inner 
rows 

Fuel filter or redesigned fuel filter 


Table A-9. Ducts and valves. 


3a. Ducts 


Component 

Problem 

Problem Cause 

Problem Solutions 

Ducts 
June 1989 

Tripod linkage failure of flex joint C 
(incident No. 32) 

Fatigue initiation at undersize fillet 
radii region 

DAR 2296: limit use with a HPFTP with 
synchronous frequencies greater than 
609 Hz; restriction of time accumulated 
at power level greater than 104 percent; 
restriction based on power level 
equivalency derived by direct correlation 
to the failures; verify fillet radii 

June 1985 

Titanium high-pressure duct flange 
cracking 

H2 assisted sustained load cracking 
due to joint preload 

Reduced joint preload; initiated a 
penetrant inspection at every 45-day 
interval; redesigned using new material 
(Inconel 718™); all titanium ducts have 
been removed from the flight program 

June 1984 

Low-pressure fuel duct buckling 

Pressure built-up between duct and 
nickel plating caused by cryo 
pumping during propellant bleed 
cycle 

Install helium bag; redesign foam 
system (bonded foam) 


Incoloy 903™ corrosion (pitting of 
the flange sealing surface) 

Incoloy 903™ susceptible to 
corrosion 

Flange groove relapped to remove 
corrosion; new material of plating on 
seal being tested at this time for possible 
future modification 

October 1989 

Flex duct overangulation 

Engine yaw stiff-arm disengaged 
resulting in overangulation; human 
error 

Engine visually inspected; remove and 
replace the articulating fuel bleed duct; 
complete FRT’s while gimbaling the 
engine in the allowable envelope 

January 1990 

High-pressure fuel duct failure 
during cryogenic proof test 

Ruptured at 8,000 lb/in 2 on first 
pressure cycle to 8,360 lh/in 2 , 
oxygen contamination of weld 
resulting in brittle fracture titanium 
weld 

Palmdale facility modified/qualified for 
titanium welds (all flight ducts are now 
made of Incoloy 7 1 8™) 

February 1992 

Tom LPFT discharge duct flex joint 
liner 

Liner was installed in a reversed 
direction of flow, due to reverse flex 
joint flanges 

Liner flow direction verification 
implementation initiated at flex joint 
level, fabrication level, and engine 
assembly level; reinspect all fleet ducts 
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Table A-9. Ducts and valves (continued). 


Component Problem 


July 1991 Low-pressure oxidizer duct bellow 

ply failure 


November 1990 Field site stretch fastener 
requirements 


October 1990 RS007030 prebumer fuel duct 

failure during proof test 


Rigid fuel bleed duct stress 
corrosion cracking 
1985 first occurrence 
1988 second occurrence 



September 1988 


LPOTP discharge duct flex joint 
antibacklash tie pin (UCR A020205) 


July 1986 I Elongation of hydraulic supply hose 


August 1982 Discharge duct failure (incident No. 
27) 


Problem Cause 


Fatigue crack propagate through 
inner ply; lox leaks into inner ply 
cavity during operation; lox expands 
during posttest warmup resulting in 
inner ply deformation and bulging 


Requirements specified in the 
specification were too tight 


Duct was not heat treated; portable 
hardness tester results invalid on 
Incoloy 903™ 


Stress corrosion cracking of CRES 
21-6-9 material 


Tensile failure during fabrication 
due to a misuse of a tooling fixture 


Undersize braid wire; mishandling 
(UCR A004122) 


Mounting of experimental ultrasonic 
flowmeter to high-pressure oxidizer 
duct led to HCF rupture of duct wall 
resulting in pump unloading, 
overspeed, and turbine disk failure 
in parallel with rubbing, internal 
fire, and pump housing rupture 


Problem Solutions 


All bellows inspected posttest visually 
for bulging; life limit imposed per FLC 
2595 (50 percent of the failed unit) 


Relaxed tolerance requirements based 
upon statistical analysis and revised the 
baseline analysis for the bolt joints; 
revise specifications per ECP 1 197 to 
impose specific calibration requirements 


All components in the particular heat 
load verified; limits of portable tester 
determined; reviewed heat treat practices 
and fabrication flowpath of hardware 


All CRES 21-6-9 material ducts; 
application of zinc chromate primer and 
strontiumchromate overcoat as inhibitor 
(STS28 to present); reinspect corrosion 
protection integrity at 2, 4, and 6 years 
on one unit 


Revise flex joint and duct drawings to 
add notes to prevent compression of the 
flex joint and resulting tensile load on 
antibacklash tie; inspected next six flex 
joints via x ray to verify corrective 
action 


Procurement inspection plan amended to 
measure and record the braid wire 
diameter used on each unit; measure the 
length of the hose before and after the 
proof test 


• Establish criteria for mountings on 
lines, ducts, and pressure vessels 

• Require government approval for 
configuration changes from that which is 
certified 


Component 


Valves 

December 1978 



Problem 


MOV fire 901-225 (incident No. 12) 


MFV housing crack E2002 (incident 
No. 14) 


PCA accumulator cap 


Problem Cause 


Fretting of inlet sleeve due to flow 
oscillation at 4x HPOTP shaft 
speed; fire initiated in the inlet 
sleeve to bellows flanged joint 


High-cycle fatigue failure; most 
probable cause of crack initiation 
was stress corrosion cracking during 
heat treatment 


During proof test testing, the 
accumulator cap deflected and lost 
its sealing capability 


Problem Solutions 


Increase sleeve and flange thickness; 
sleeve bolted with 16 screws and locked 
with cup washers; replace laminated 302 
SS shims with one Incoloy 718™ space; 
apply dry lube to selected interfaces 


Life limit imposed based upon an 
analysis correlated with failure and fillet 
radii in the failure region (interim fix); 
completely redesigned cam follower 
area; (increase fillet radii) and 
implementation of process change 


Redesign the PCA accumulator cap to 
increase its thickness from 0.400 to 
0.650 in and increase the length of the 
two attachment bolts 
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Table A-9. Ducts and valves (continued). 


Component 

Problem 

Problem Cause 

Problem Solutions 

May 1982 

OPOV seal failure (incident No. 26) 

Shutdown sequence allows hot gas 
to propagate to ASI tee-block; seal 
eroded by hot-gas impingement 

Modified the shutdown sequence for 
shutdown after 5.0 s; shutdown between 
1.5 and 5.0 s requires ball seal 
replacement 


Pogo accumulator Z baffle cracks 

Turbulent buffeting by main 
oxidizer flow caused high-cycle 
fatigue cracks, which initiated in top 
flange of baffle vanes 

Required the vane edges to be 
chamfered; crack length of 0.15 in or 
less deemed acceptable by analysis 

June 1978 

Fuel inlet blocked by nitrogen 
(incident No. 8) 

Solidified nitrogen collected in the 
screen in the main propellant duct 
and restricted hydrogen flow to the 
LPFP; the nitrogen was introduced 
into the tank during pretest 
chilldown operations due to an 
incomplete electrical interlock 
between the two tank vents, the 
forward engine chill valve, and the 
tank vent line, GN purge; and the 
incorrect positioning of the main 
propellant duct bleed valve and the 
forward engine chill valve 

• Modification of LH tank vent line 
purge sequencing interlock 

• All run tank vent line purges converted 
to helium 

• Relocation of LH barge tank vent line 
purges to preclude backflow to the barge 
tank 

• Modification of test stand chilldown 
procedures and safe-guarding systems 
and procedures 

• Implementation of engine inlet 
pressure redlines 


B. Solid Rocket Motor/Boosters (RSRM/RSRB) 

Although, on the surface, it appears that the RSRM/RSRB is nothing but a large, simple booster, 
it turned out to be a very complex system with many development problems. The complexity was 
further enhanced by the requirement to recover and reuse the system 20 times. The magnitude and 
complexity of the problems listed (table A- 10) point clearly to this observation. The harshness of the 
reentry, water impact, and recovery operations clearly added to the problems. The ablative gimbaled 
nozzle has been the source of many concerns and problems. The joints and seals are a constant concern 
and were the cause of the Challenger accident that destroyed the shuttle and killed the crew (Presidential 
Investigation Committee Report). 

There were several lessons learned in the RSRM/RSRB program. Since the SRM/SRB dry 
weight only cost 1 lb of payload for each 10 lb of dry weight, it was a good trade to add conservatism in 
the design by using maximum/minimum loads, which then allowed load increases without redesign. The 
lesson: robustness early in a program provides flexibility to solve downstream problems. 

The SRM clearly taught that an apparently simple system that contains high energy (pressure, 
temperature, thrust) is in reality very complex, requiring great care and attention to prevent failures. 
When additional functions such as providing control authority, more complexity and issues are added. 
From a system perspective, however, the best place to put control authority is where the potential 
authority resides (SRM thrust). In this case (space shuttle), major control disturbances also came from 
the SRM natural thrust misalignments. Taking this disturbance out at its source is good logic. 
SRM/shuttle reinforces the axiom that all design is a balancing act, a series of trades, giving up some 
things in order to get others you want or need. 

The matrix (table A- 10) provides a listing of many of the problems experienced in the project 
and should serve as a technical base for problem avoidance in the future. 
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Table A- 10. SRM/SRB problems. 


Component 

Problem 

Problem Cause 

Solution 

Aft skirt 
STA-2B - 1986 
STA-3 - 1988 
Bracket - 1994 

Structural failure occurred during 
static test at loads below design 
requirement; large cost associated 
with NDE inspection of critical 
region 

A weld joint in the primary load- 
carrying structure fails at strain 
levels far below the values 
predicted by materials testing 

An external bracket has been 
designed to reduce the strain in 
the weld; the bracket was tested in 
the first quarter of 1994 

Bracket - 1994 

Failure of nominal configuration 
at higher than STS-3 load 

Study in process 

Pending 

All aluminum components 

Corrosion - Significant amounts 
of salt water corrosion are evident 
on much of the SRB hardware 

The repeated exposure of 
aluminum to salt water is causing 
a deterioration of the SRB 
components 

Cost-effective NDE and analysis 
methods are being considered 

Forward skirt 

Water impact and tow back 
damage 

Forward skirts have been scrapped 
due to extreme water impact 
damage; the skirts leak water 
during tow back, damaging 
expensive electronics 

Water impact damage is 
considered attrition; leakage 
problem has been reduced by 
improved door seals 

SRB attach struts 

Expensive NDE and proof testing 

Conservative fracture mechanics 
analysis 

Reduction in NDE requirements 
by improvements in analysis 

ET attach ring 

Expensive NDE and damage 
assessment 

Water impact loading can cause 
significant damage to the ring 

None 

Systems tunnel 

Assembly 

Occasional problems in assembly, 
caused by buildups in the 
tolerance along the length of the 
tunnel 

Engineering has been put in place 
to allow slotted holes and large 
washers to be used during 
assembly 

Nose cap 

Thrust post did not receive proper 
heat treat 

Lack of vendor quality control 

Thrust posts removed and 
replaced 

SRB separation motors, 
1979 

Potential for plume impingement 
damage to orbiter tiles 

Size of particles in propellant 
combustion products 

Minimized propellant aluminum 
content, 2 percent; extensive test 
and analysis verification 

SRB nose cap, 1988 

Shedding of thermal protection 
material damaged orbiter tiles 

Nose cap assembly age and TPS 
material properties 

Developed and implemented new 
TPS material 

Blast container system, 
1988 

Frangible holddown nut debris 
lost 

Inadequate blast container design 

Designed, built, tested system 
with plunger connected to 
holddown bolt by frangible link to 
close container 

Holddown bolt hangup 

Broaching of bolt in aft skirt hole 
during lift-off 

Bolt rotation after frangible nut 
separation 

Optimized frangible link size; 
minimize bolt velocity loss and 
constrain bolt to axial translation 

TVC system, 1982 

50 Hz oscillation in TVC system 
during ground test 

Limited cycle oscillation was 
caused by feedback of nozzle 
modes through actuator 
differential pressure loop at the 
elevated hydraulic fluid 
temperature seen in ground tests 

Established fluid temperature 
limits for LCC; analysis indicated 
any flight oscillations would be 
less than ground test experience; 
no function or structure 
degradation 

Recovery system main 
parachute floats, 1 982 

Floats for two main parachutes 
entangled during deployment, 
destroying one chute on STS-3 

Floats being stored above chute 
packs and frustum tilt during 
deployment 

Change float design such that 
floats are stowed below main 
chute packs and attached to risers 

Recovery system 
g-switch, 1982 

Loss of both boosters on STS-4 
when chutes were prematurely 
released 

G-switch for releasing mains at 
water impact was triggered by 
pyro shock at frustum separation 

Electronically block out g-switch 
until after frustum separation 

Recovery system main 
parachutes, 1992 

Excessive deployment damage 

Chute contact with structure 
inside frustum during deployment 

Install rip-stops on all main chutes 
to reduce damage propagation due 
to deployment load 
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Table A- 10. SRM/SRB problems (continued). 


Component 

Problem 

Problem Cause 

Solution 

Aft SRB components, 
1981 

Water impact damage 

High-impact velocity 

Changed main chute size from 
1 15 to 136 ft and applied foam to 
aft skirt internal components 

SRB aft skirt aft ring, 
1982 

Water impact damage 

Intact thermal curtain 

Reduced curtain strength and 
reverified functionality for 
ignition overpressure 

Aft skirt thermal curtain, 
1982 

Structural failure during reentry 

Aerodynamic flutter 

Risk of reentry thermal damage 
acceptable weighed against 
increased water impact damage 
with stronger curtain 

Rate gyros in forward skirt 

Post separation damage 

Potentially reentry/vortex 
shedding water impact, tow back 
environment 

Perform gyro functional 
acceptance testing prior to reuse 

Rate gyros in forward skirt 

Gyros/mounting structure tuned 
with fourth SRB bending mode 

Mounting structure flexibility 

Reinforced mounting structure 

SRB, 1979 

Excessive reentry acoustics 

Nozzle acoustics during reentry 

Designed to separate nozzle aft 
exit cone at apogee 

Aft skirt internal 
components, 1981 

Thermal damage 

Reentry heating/hydrazine fire 

Delayed nozzle aft exit cone 
separation until after maximum 
reentry heating 

Main parachutes 

Lagging inflation failure to inflate 

Inherent to large chutes deployed 
in clusters 

Various improvements 
implemented; vent cap addition, 
packing changes 

Reefing line cutter 

Failed to fire 

Pull angle too large 

Acceptable risk; redundant cutter 
worked, low probability of high 
pull angle 

Pilot chutes 

Negative margins 

Increased deployment loads due to 
higher SRB apogee 

Waivers for higher load based on 
test, then the pilot chute was 
redesigned 

Drogue deployment bag 

Negative margins 

Increased deployment loads due to 
higher SRB apogee 

Waivers for higher load based on 
test, then the drogue bag was 
redesigned 

Main parachute support 
structure 

Negative margins at comer 
fittings and frustum shear beam 

Increased deployment loads due to 
higher SRB apogee 

Waivers due to nonsafety of flight 
issue, then enlargement of comer 
fitting bolts and holes 

Main parachute deck 
fittings 

Negative margins 

Increased deployment loads due to 
higher SRB apogee 

Redesigned fittings with larger 
pins and flanges 

Thrust vector control 
system frames 

Weld cracks 

Lack of full weld penetration due 
to configuration design 

Analysis indicates the weld is not 
required; frames are fully 
inspected prior to use 

ASRB IEA box 

Orbiter wind load 

IEA box location 

Value added by changing box 
location, reducing wing load, less 
than cost of new aero data bases; 
IEA location was not changed 

SRB IEA box, 1982 

Vibration criteria exceedance 

IEA box hard mount 

Designed, developed, built 
vibration isolation system 

SRB APU, 1979 

Vibration criteria exceedance 

APU hard mount 

Design vibration isolation system 

SRB APU 

Turbine blade root and tip 
cracking 

Unknown 

Statistics/analysis employed to 
determine critical crack size (0.09 
in) and required time between 
inspections (16 hot firings, 2 
flights) 

ET RSS electronics panel 

Vibration criteria exceedance 

Panel hard mount 

Designed vibration isolation 
system 
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Table A- 10. SRM/SRB problems (continued). 


Component 

Problem 

Problem Cause 

Solution 

SRM field joints, January 
28, 1986 

Leakage of combustion gases 
causing the 5IL disaster 

Seal response was inadequate for 
the joint displacement/rate at 
ignition 

Redesigned the joint to decrease 
displacement/rate by 10X and 
heated seals to enhance response 

SRM stiffener stubs 

Cracks occur at stub holes, 
potential unsafe condition for 
reuse 

Water impact 

Repair damage by removing stress 
concentrations 

RSRM igniter seals, 1988 

High seal temperature required for 
seal resiliency, putty blow holes 

Joint displacement magnitude, use 
of putty 

Redesigned joint, reducing 
displacement and replacing putty 
with insulation j-seals 

RSRM case segments, 
1991 

Forward case segments buckled 

Water impact, slap down event 

Water impact damage accepted as 
attrition 

RSRM nozzle/case joint 
1992 

Gas path through polysulfide, 
blowby of wiper O-ring 

Trapped air at nozzle assembly 
forced through uncured 
polysulfide; wiper O-ring/NBR 
contact not intended as seal 

Extensive study indicated no 
change required; primary and 
secondary seals fully functional 

RSRM aft dome Y joint, 
1992 

Heat treatment cracks missed by 
NDE 

Pooling of mag/particle fluid; 
eddy current of painted metal 

Changes in NDE procedure and 
analytical verification of proof test 
screening 

RSRM, 1993 

Bum roughness at 65 to 75 s bum 
time 

Collection, entrainment, ejection 
of molten slag 

Statistical quantification of 3- 
sigma mag, structural assessment, 
and process controls to prevent 
changes 

RSRM forward case 
segment, 1993 

Inclusion crack in interior 
membrane missed by NDE 

Unknown 

Safety of flight ensured by 
pressure proof test screening of 
cases 

RSRM nozzle, 1994 

Phenolic liner/metal debonds 

Study in process 

Partial solution - implementation 
of silane primer on metal parts 

RSRM propellant, 1979 

Analytical representation of 
stiffness 

Inadequate computer 
methodology for modeling 
propellant and pressure 

Developed empirical 
stiffness/pseudo-pressure effect 
using one-fourth-scale test data 

RSRM propellant, 1 993 

Analytical representation of 
stiffness 

Inadequate computer 
methodology for modeling 
propellant and pressure 

Developed modification to 
NASTRAN differential stiffness 
code 

RSRM nozzle 

Excessive erosion, pocketing 

Nonoptimum composite part ply 
angles 

Changed ply angles for phenolic 
rings 

RSRM combustion 
chamber 

16 and 32 Hz press oscillations 
during motor bum 

First two acoustic, organ pipe 
modes 

Accumulated statistical data base, 
computed maximum 3-sigma 
magnitude, included effects in 
systems loads equations for 
structural assessment 

SRM filament wound case 

STS-2 failure under prelaunch 
loads 

Excessive delams during 
manufacture 

Process changed to adequately 
wet winding fibers with epoxy 
resin (program canceled, 
improvements implemented in 
Titan project) 

SRM filament wound case 

Excessive motor elongation at 
ignition 

Bending deflection of steel joints 
and soft composite/steel 
connection at joints 

Changed winding pattern so that 
composite case portions decreased 
in length at ignition 

ASRM test segment 

Segment failed at 10-percent 
proof load 

Incorrect heat treat for massive 
bolted joint, NDE failure to find 
cracks 

Recommended design specific 
heat treat profile be developed; 
removed NDE supplier from 
approved list 

ASRM/RSRM flex 
bearing 

ASRM torque greater than CEI 
specified requirement 

Interpretation of requirement 

Clarify division between ASRM 
and ASRB torque contributions 
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Table A- 10. SRM/SRB problems (continued). 


Component 

Problem 

Problem Cause 

Solution 

RSRM flex bearing 

Delaminations 

Uneven heat distribution during 
bearing cure process 

Relocated heating elements on 
bearing hemispherical shims 

Nozzle boot ring 

Boot failure on DM-8 

Unsuccessful boot ring redesign 

Changed to a dual-ply angle 
design 

Propellant 

Cracks 

Stress concentration at star 
grain/center post transition 

Changed local propellant shape to 
eliminate stress concentration 

ET/SRB strut 

50-percent through crack 

Lack of weld penetration 

Improved welding 

RSRM thrust 

Pressure/thrust spike 

Slag ejection 

Statistical loads bound determined 
acceptable 

RSRM nozzle 

Joint 3 primary seal erosion 

Gas paths through RTV backfill 

Process change 

RSRM liner, insulation 

Environmental 

Asbestos used in liner, insulation 

Replacement material, Kevlar™ 
filled NBR, being 
developed/tested 

RSRM component 
refurbishment 

Environmental 

Cleaning processes use ozone 
depleting compounds 

Spray-in-air aqueous cleaning 
solution processes being 
developed/tested 

RSRM bonds 

Environmental 

Bonding processes use ozone 
depleting compounds 

Non-ODC replacement adhesives 
are being developed/tested 

RSRM bonds 

Increased findings of low density 
areas 

Improved NDE sensitivity 

Reassessment of bonds, 
significance of LDA’s, 
realignment of data base 

RSRM 36 nozzle 
nose/inlet assembly 

Aluminum/phenolic unbonds, 
suspect ascent condition 

Reentry/ water impact 
structural/thermal loads 

Bond improvement using silane 
primer, comprehensive team 
assessment indicated not ascent 
problem 


C. External Tank 

The ET, although probably the simplest of the shuttle elements due to its expendable requirement 
(throw away), had many complex issues and concerns. Since 1 lb of tank structural weight was 
approximately equal to 1 lb of payload, it was imperative to control and reduce weight. Ensuring tank 
break up on reentry further complicated the system. Welding and ensuring weld integrity was and is a 
major concern since there is over one-half mile of welds in each tank and a leak is not acceptable. 
Insulation to maintain propellant conditioning and propellant management was a major design issue, 
particularly since debonded TPS could come loose and damage the orbiter reentry heat protection tiles 
during the ascent maximum dynamic pressure regime. The shear size, coupled with highly accurate 
geometric dimensions, led to the development of complex accurate tooling and jigs that have been key 
to tank manufacturing quality. 

Several lessons stand out from the tank program. First, NDE and proof test is a safety-critical 
process and is a key to producing quality hardware. This discipline, fracture control/fracture mechanics, 
must be a prime requirement for safety-critical hardware, particularly large cyro-propellant tanks. 
Second, manufacturing is a fundamental part of the design process and must be pursued concurrently 
with the hardware design in a systems or integrated approach. Third, if the environments are well known 
and the materials (hardware base products) are well characterized, criteria such as safety factors can be 
reduced to increase performance. Fourth, process control from the ingot, to the forming, to welding, 
must be characterized, understood, and controlled to achieve quality products. Since these different steps 
usually occur in different industrial elements, communications, etc., is vital. 

The matrix (tables A-l 1 and A- 12) gives a history of the type of problems that can be expected 
in the development of propulsion system propellant tankage. 


213 




















































Table A-l 1. ET problem outline. 


Problems are broken down into the following categories; 

1 .0 Systems problems 

1 . 1 Shuttle systems problems 

1.1.1 Trajectories 

1.1.2 ET disposal 

1.1.3 Loads 

1.1.4 Environments 

1.1.5 Range safety 

1.1.6 Launch commit criteria 

1.2 ET systems 

1 .2. 1 Preflight problems 

1.2.2 Loading problems 

2.0 Structure problems 

2. 1 Design requirements 

2.2 Design assumptions 

2.3 Structural changes 

2.4 Fracture control 

2.5 Pyrotechnics 

2.6 Structural test 

3.0 Thermal protection systems problems 

4.0 Ground handling and operations problems 

5.0 Instrumentation problems 



Table A- 12. ET problems. 


1 .0 Systems problem list 


Area 

Problem 

Problem Cause 

Problem Solution 

1 . 1 Shuttle systems problems 




1.1.1 Trajectory effects 

Design trajectories are 
conservative 

Design trajectories based on 3- 
sigma systems dispersions lead 
to conservatisms 

Accept conservatism initially 
and redefine dispersion values 
as flight data and experience 
become available 


Abort and ET disposal targeting 
leads to more severe induced 
environments 

Necessity to achieve abort and 
disposal targets requires flight 
path and attitudes that increase 
environments 

Accept increased environments 
to ensure abort and disposal 
requirements are met 


Load relief measures to protect 
orbiter wind create impact on 
performance, control, and 
induced environments 

Max “q” trajectory changed 
from -2° to -6" 

• Trajectories are designed for 
best compromise that minimizes 
impacts 

• Wind constraints were 
instituted 

• Accept performance and 
launch probability reductions 

• Wind constraints were 
instituted 

• Accept increased protuberance 
airloads 


Day of launch 1-load updates 
(DOLILU) instituted to base 
trajectory shaping on measured 
winds on the launch day in order 
to improve launch probability 

Trajectories based on DOLILU 
protect the vehicle from 
excessive loads but can increase 
heating 

• Algorithms to indicate loads 
for critical areas were developed 
to assess the acceptability of the 
various DOLILU options 

* Design thermal environments 
were increased to protect against 
the heating increases possible 
with DOLILU options 


Generic certification leads to 
more severe design 
environments 

Desire to minimize preflight 
analysis activities led to more 
all-encompassing flight 
conditions for certification and 
resulted in more severe design 
environments 

Accept more severe design 
requirements to minimize 
operational cost 

1.1.2 ET disposal 

The ET must be jettisoned after 
MECO in an acceptable manner 

The ET (actually its pieces that 
result after aerodynamic 
breakup during entry) must be 
made to impact in preselected 
ocean areas for ground safety 
considerations and in 
accordance with international 
treaties; this applies to all flight 
cases, whether under normal 
flight or abort conditions 

• Trajectory shaping is required 
to allow the ET to be released 
under the proper conditions to 
impact in the preselected 
locations 

• A propulsive '‘tumble valve” 
was included on the first 22 
flights to cause the ET to tumble 
during entry and thus provide a 
more stable entry that neither 
“skips” out of the atmosphere 
nor “dives into” the atmosphere 
(valve was removed after flight 
experience showed it was not 
necessary for acceptable debris 
footprints) 


Requirement for ET to remain 
intact until altitude is below 
294,000 ft results in more 
thermal protection 

To minimize debris footprint, 
ET must not break up until it is 
below 294,000 ft 

Accept additional TPS to 
comply with break-up 
requirement 


Inability to predict ET break-up 
altitude 

Uncertainties in analysis caused 
an inability to accurately predict 
break-up altitude 

Measurements of break-up 
altitude by DOD resources were 
used to develop a statistical data 
base for break-up prediction 
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Table A- 12. ET problems (continued). 


1.0 Systems problem list 

Area 

1 . 1 Shuttle systems problems 
1.1.3 Loads 


1.1.4 Environments 


Problem 


Strut loading was excessive 


SSME startup (and shutdown 
for abort cases) cause excessive 
loads 

SRM thrust variations can 
aggravate flight loads 


Change in pressurization 
method increased loads 


Aerodynamic heating prediction 
uncertainties 


Plume-induced heating 
prediction uncertainties 


Booster separation motors 
impinged on ET foam during 
SRB separation 


Problem Cause 


Cryo shrinkage of ET affects 
strut loading 

Simultaneous startup or 
shutdown from all three 
SSME’s induces extreme loads 

SRM chamber pressure 
oscillations are caused by 
internal motor acoustic modes 
and result in increased flight 
loads, reduced margins on 
intertank buckling, and caused 
some welds to be inadequately 
proof tested 

Change to fixed orifice 
pressurization increased L02 aft 
dome loading 


Trajectory, configuration, and 
methodology uncertainties, and 
initial lack of data led to 
conservatism in predictions and 
excess TPS weight 


Trajectory, configuration, and 
methodology uncertainties and 
initial lack of data led to 
conservatism in predictions and 
excess TPS weight 


SRB separation motors must 
point toward ET for proper 
separation of boosters 


Problem Solution 


Struts were pretensioned to 
minimize loading effects 

Startup and shutdown of 
SSME’s was staggered 


• Added factor to SRM thrust 
loads to account for oscillations 

• Certified structure for 
increased loads 

• Added postproof test x-ray 
requirements for inadequately 
proofed weld areas 


• Added factor to account for 
increased pressure 

• Certified structure for 
increased loads 

• As trajectory and 
configuration matured, more 
detailed aerothermal wind 
tunnel testing was conducted 

• Right instrumentation was 
obtained on DDT&E flights 

• Additional analysis points 
were used for specific problem 
areas 

• Prediction methodology 
techniques were improved 

• Radiation measurements were 
obtained on engine and motor 
ground tests 

• Prediction methodology 
techniques were improved 

• Right instrumentation was 
obtained on DDT&E flights 

• Additional analysis points 
were used for specific problem 
areas 

• Sep motors were moved to 
preclude direct normal 
impingement on ET 

• Testing was performed to 
quantify impingement effects on 
foam 

• Aluminum content of 
separation motors was reduced 
to minimize erosion of foam 


Ascent acoustics uncertainties 


Trajectory, configuration, and 
methodology uncertainties and 
initial lack of data led to 
conservatism in predictions 


• An early acoustics test (IS 1 ) 
provided general acoustics 
levels 

• Some flight instrumentation 
was obtained on DDT&E flights 

• Additional analysis points 
were used for specific problem 
areas 
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Table A- 12. ET problems (continued). 


1.0 Systems problem list 


Area 

Problem 

Problem Cause 

Problem Solution 

1.1 Shuttle systems problems 
1.1.4 Environments (cont.) 

Unsteady airflow over cable 
trays caused structural concerns 

Normal flow over raised cable 
trays can cause “galloping 
instabilities” and extreme 
structural responses 

• Several subscale tests were run 

• Experts were put under 
contract 

• Foam ramps were added to the 
ET at cable tray locations to 
protect from this phenomenon 


Airloads on foam protuberances 
caused structural concerns 

Airflow to flat-faced foam 
protuberances can cause them to 
shed debris 

• Several subscale tests were run 

• Foam ramps were added to the 
ET at protuberance locations to 
protect from this phenomenon 

1.1.5 Range Safety 

Commanded destruct of the ET 
is required for civilian safety; 
nonfunctioning is unacceptable 
and has been the cause of launch 
scrubs; premature functioning 
would be catastrophic 

Commanded destruct caused 
addition of explosive charges, 
antennae, electronics, additional 
TPS, ground stations, and many 
ground checks 

• Range safety electronics 
package was added to ET 
intertank area and cross- 
strapped to the boosters 

• Antennae were added to 
receive commands 

• Linear shape charges and fuses 
were added, which required 
special thermal protection 

• Many preflight readiness 
checks were instituted 


Deletion of the linear shape 
charges pursued as a means to 
eliminate a criticality 1 failure 
point 

Removal of charges only 
possible if tanks can be 
destructed by other means 

• Linear shape charge on LH2 
tank removed as analysis 
showed it would be destructed 
when SRB’s are destructed 

• Linear shape charge on L02 
tank could not be removed 

1.1.6 Launch commit 
criteria 

Low temperature damage 

Low ambient temperatures can 
cause ice formation in areas 
where water has collected and 
can damage components 

Constraints were placed on the 
shuttle system to prohibit 
propellant loading and launch if 
ambient temperature limits are 
violated 


Lightning damage 

Lightning effects can damage or 
.destroy the ET or its 
components 

♦ Lightning rods were placed on 
the launch pad to protect the 
vehicle while on the pad 

• Constraints were placed on the 
shuttle system to prohibit 
propellant loading under 
lightning conditions and to 
prohibit flight when conditions 
in the flight path can cause 
lightning 


Wind damage 

Hurricane force winds can 
damage the ET on the launch 
pad and high winds in flight can 
damage ET structure 

* Shuttle vehicle is moved back 
into the VAB if hurricane force 
winds are predicted 

• Constraints were placed on the 
shuttle system to prohibit flight 
if the winds aloft are predicted 
to cause vehicle load 
exceedences 


Debris damage 

Debris at launch or during flight 
can damage orbiter tiles or 
windows 

• Launch pad has all loose 
objects removed before flight 

• Shuttle is prohibited from 
launch if ET has any external 
ice in certain areas or over 1/16 
in of ice in other specified areas 
or if the ET has any condition 
that can shed harmful debris 
during flight 
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Table A- 12. ET problems (continued). 


1.0 Systems problem list 


Area 


1.2 ET systems problems 
1 .2. 1 Preflight problems 


1.2.2 Loading problems 


Problem 


Difficulty in mating ET to 
shuttle stack 

Difficulty in mating ET to 
shuttle stack 


Components and materials have 
limited lifetimes 


TPS materials were thought to 
soak up moisture during on-pad 
stay time; materials 
performance degradation and 
vehicle weight gain are potential 
penalties 

Damage to the exterior foam 
TPS has been experienced at the 
pad 

Propellant gas boiloff must be 
ducted away from vehicle 


The ET shrinks during loading 


The ET can form an external 
layer of ice for certain weather 
conditions 


Geysers and “water hammer” 
effects can be caused during the 
L02 loading process and can 
harm the ET 


All “compartments” on the ET 
must be protected from the 
buildup of hazardous gases 


Problem Cause 


Lack of space between ET and 
boosters at forward attachment 

Ball fittings on ET did not 
match up exactly with orbiter 
attach points 

Range safety pyrotechnics, 
batteries, and various other 
components have limited 
lifetimes 

Open cell materials can soak up 
moisture during rain and from 
humidity at pad 


Woodpeckers and other birds 
have damaged the foam TPS 


GH2 is potentially explosive 
and G02 coming from the ET 
louvers can affect the 
flammability of the ET foam 
insulation 


The cryogenic propellants cause 
the ET to shrink 


Cryogenic propellant 
temperatures will, with time, 
“cold soak” through the external 
insulation and cool the external 
surface of the ET 


Gas bubbles can form when 
cold L02 is pumped through the 
initially warm, long, and vertical 
feedline that is used to load the 
L02 tank; this can lead to 
geysers and “water hammer” 
effects 

Leakage from propellant line 
joints could cause an 
unacceptable concentration of 
hazardous gases 


Problem Solution 


Shaved off some of the ET foam 
around forward attachment area 


Procedures put in place to track 
ages of all limited life items to 
ensure they will be within their 
limits at launch 

The first two ET’s were painted 
with a moisture barrier; the 
closed cell foam on the exterior 
of the ET was later shown to be 
a sufficient moisture barrier and 
the 600 lb of paint was removed 

Damage repaired as required 
and bird repellent devices have 
been implemented on the pad 

• GH2 is ducted off to a bum 
pond next to the launch pad 

• A vent hood is provided to 
scavenge the G02 from the nose 
louvers of the ET where it is 
mixed with GN2 and ducted 
away from the vehicle 

• Attachment structure to the 
other shuttle elements must 
rotate to account for the 
shrinkage 

• The LH2 tank and L02 tank 
must be pressurized during 
loading to protect structural 
margins and the TPS bondline 
integrity 

• A sufficient thickness of foam 
insulation is applied to the 
propellant tanks to preclude ice 
formation for most loading 
conditions 

• An algorithm that predicts ice 
formation is used to assess 
whether unacceptable is forming 
during loading 

• An “ice team” physically 
inspects the ET before launch 

• Initially a separate anti-geyser 
line was installed on the ET; this 
line was removed after several 
flights 

• A gaseous helium injection 
system was installed on the 
feedline to mitigate these effects 

All internal compartments (such 
as the intertank nose cap) are 
continually purged with inert 
gases during the loading process 
to keep hazardous gases below 
specified concentration limits 
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Table A- 12. ET problems (continued). 


2.0 Structures 


Element 

Problem 

Problem Cause 

Problem Solution 

Lox Tank 

Tank buckled during filling with 
water (forward ogive) 

Filling without internal pressure 

Procedure change for operations 


Damping during modal test was 
very low for high tank fill levels 

Modal coupling between 
structures and fluid modes 

Accounted for effect in pogo 
analysis and pogo suppression 
device design 

Hydrogen Tank 

Aft section of tank oil canned 
during dynamic test 

Dynamic test was run ambient 
(flight is cryogenic), thus SRB 
to ET strut is canted T from 
perpendicular; cant caused rear 
I-beam (circular) to rotate 
creating canning 

Not an operational range since 
cryo effects would put strut into 
perpendicular position 


Aft dome buckled during 
structural testing of an 
unpressurized prelaunch 
condition 

The strut loads introduced by 
cryo shrinkage during hydrogen 
tank fill caused the aft bulkhead 
to buckle 

Struts were prestressed in 
compression to reduce load for 
original tank; the lightweight 
redesign added material, 
eliminating the need for strut 
prestressing 


LH 2 tank cable tray support 
cracked at 80% limit load but 
carried 200% limit load 

Glass phenolic broke in bond 
line due to shift but weak load 
path 

TPS trapped debris carried load; 
redesigned for super lightweight 


Proof test failure of stabilizing 
arc frame tension splice 

Bolt hole pattern was in line, 
introducing large local loads 

Redesigned bolt hole pattern to 
not be in line 


SLA (insulation) bonding failed 
upon LH 2 loading 

Thermal distortion coupled with 
lack of cleanness during 
bonding 

Revised procedures 


LH 2 feedline “milk stool” failed 
during static test at vendor 

Underdesigned 

Redesigned 


LH 2 siphon line failed during 
static test; also failed random 
vibration test due to screen 
separation 

Permanent set in material 
caused line to buckle 

Redesigned 

Scasols 

Pressure transducer vibration 
qual test failure 

Over test due to wrong input 
spectrum 

Ran new unit to correct levels 


Temperature sensor vibration 
test failure 

Failure in protective cover 

Cover not required, eliminated 
and solved problem 

Other 

Gaseous oxygen (G0 2 ) 
pressurization sliding bellows 
collapsed during pressure test 

Underdesigned 

Redesigned 


Protuberance airload ramps 
(PAL) cracked under applied 
deflection 

Test up simulator of tank skin 
was too long and did not 
represent actual situation 

Retested with proper simulation 


G0 2 press line lower flex joint 
failed during static load test 

Rupture of bellows support 
structure (BSTRA) bellows; 
BSTRA was underdesigned 

Redesigned BSTRA 


Range safety system (RSS) 
panel failed in random vibration 
test 

Insulator was inadequate 

Redesigned to be isolators; 
retested and passed 


RSS panel failed in random 
vibration test 

Response was larger than 
predicted 

Redesign 

Nose Cone 

i 

Lightweight replacement 
composite nose cone failed 
during development test 

Missed coefficient of thermal 
expansion and inadequate 
design of mating bolt holes; 
breakdown in system 
requirements 

Redesigned unit to proper 
systems requirements 
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Table A-12. ET problems (continued). 


2.0 Structures 


Element 

Problem 

Problem Cause 

Problem Solution 

Fracture Mechanics 

Concern over crack acceptance 
criteria after Challenger 
accident 

Formed Blue Ribbon Panel of 
fracture experts to review 
approach and make 
recommendations 

Criteria and procedures were 
changed; supported by detailed 
analog coupon testing of 
cracked specimens 

Super Lightweight Tank 

(SLWT) 

Welding problems occurred on 
the new AL-Li material; 
priming and repair 

Material properties invalidated 
weld procedures 

New procedures were developed 


Fracture toughness requirements 
in conjunction with separation 
of yield and ultimate was hard 
to achieve 

The chemical makeup and heat 
treat properties were very 
sensitive to these parameters 

Tight procedures control; lot 
acceptance of each forging 


3.0 TPS problem list 


Area 

Problem 

Problem Cause 

Problem Solution 

TPS problems 

Foam surface irregularities on 
acreage areas 

Spray system leaves waves on 
surface due to spray pattern 

• Spray pattern refined to 
minimize wave height and 
period; waviness factors (to 
account for increased heating) 
were introduced into heating 
rates 

• Criteria were placed on 
production sprays to achieve 
acceptable wave height and 
period 


Foam cannot cover all metal 
surfaces, thus allowing ice 
formation 

Areas which require motion, 
such as rotating brackets, cannot 
be covered with foam 

* Areas that cannot be foam 
covered were minimized 

• Ice debris from these areas 
were proven acceptable to the 
shuttle system 


Foam becomes debris 

Voids under foam can expel 
foam pieces during flight 

Application procedures were 
refined to minimize void 
formation 


Foam becomes debris 

Cracks in foam can cryopump 
air under the foam, which can 
expel foam pieces during flight 

Application and repair 
procedures were refined to not 
allow cracks 


Foam becomes debris 

Spraying of foam over stringers 
resulted in “rollover,” which left 
“lobes” of foam around the 
stringers that were a debris 
source 

A “two-tone” foam system was 
instituted that filled in the 
stringer areas with one foam and 
then applied a cover layer of 
foam over the now 
noncorrugated stringer area; this 
avoided the fragile “lobes” of 
foam 


Foam becomes debris 

The “two-tone” foam design for 
the intertank area suffered voids 
between the layers and shed 
foam pieces during flight 

• Hundreds of vent holes were 
drilled in the possibly affected 
areas to vent the voids and avoid 
the mechanism to eject foam 
pieces 

• A new spray method was 
developed to allow a design 
change to a single foam layer 


Foam becomes debris 

Areas of foam over ablator 
could be expelled during flight 
due to trapped gases from 
ablator outgassing during the 
foam spraying process 

Procedures were hanged to 
provide vent holes around the 
ablator during the foam spray 
application; after the ablator 
completes its outgassing, the 
vent holes are closed out 
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Table A- 12. ET problems (continued). 


3.0 TPS problem list 


Area 

Problem 

Problem Cause 

Problem Solution 

TPS problems (cont.) 

Foam becomes debris 

Foam over protuberances that 
presents a flat face to the 
aerodynamic flow will 
experience airloads that will 
break off pieces 

Ramps made of foam were 
placed in front of these 
protuberances to shield them 
from the aerodynamic flow 


Ablator causes debris 

Ablator bondline “glassifies” at 
cryogenic temperatures and will 
break when the ET is 
pressurized to flight levels and 
expands from a nonpressurized 
cryoshrunk condition 

Procedures were instituted to 
pressurize the tanks during 
loading 


Ablator causes debris 

Ablator spray formed on cable 
tray covers shrunk during cure 
process and created 
unacceptable bondline stresses 

Process was changed to 
adhesively bond “preshrunk” 
ablator pieces onto the cable 
tray covers 


TPS materials must comply with 
EPA mandates 

Original foam systems do not 
comply with EPA requirements 
for environmentally friendly 
materials 

Large effort underway to 
develop new foams that do not 
use CFC-based blowing system 


4.0 Ground handling and operations problem list 

Area 

Problem 

Problem Cause 

Problem Solution 

Ground and operations 
problems 

14,000 lb of lox inadvertently 
drained from ET; could not 
recover before launch window 
closed 

Operator did not close valve at 
proper time 

Procedures and training 
improved to avoid a recurrence 


G02 vent louvers build up 
unacceptable ice 

Cold G02 vapors exiting 
louvers condense moisture from 
atmosphere on louvers and form 
ice 

A vent hood system was 
installed on the launch pad to 
duct away the G02 and provide 
a warm, dry nitrogen purge 
around the vent louvers 


A part of the launch pad vent 
hood system, a plasticized fabric 
“collar” around the louvers, can 
adhere to the topcoat on the 
foam and pull out foam pieces at 
vent hood retraction 

When the topcoat is too thick, 
the topcoat adheres to the warm 
surface of the bag and pulls 
away from foam at retraction 

Controls have been placed on 
the thickness of the topcoat 
layer 


5.0 Instrumentation problems 


Area 

Problem 

Problem Cause 

Problem Solution 

Instrumentation problems 

Ullage pressure sensors had 
erratic readings 

Development flight 
instrumentation installations 
were said to allow ice formation 

“Stiction” problems with that 
type of sensor caused erratic 
readings 

Foam could not be placed over 
“instrument island” locations or 
data would be compromised; ice 
could form on these islands 

New type of sensor that does not 
suffer “stiction” problems was 
qualified for use 

• DFI islands were removed 
from STS- 1 if they were on the 
orbiter side of the ET 

• Island mountings were 
improved to reduce ice 
formation potential 


V. HUBBLE SPACE TELESCOPE 


The Hubble requirements are: (1) long-term lifetime on orbit with planned refurbishment and 
orbit reboost and (2) highly accurate pointing control for science created many design and operational 
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problems; all of which have been solved or worked around, producing a very successful program. HST 
is a program that has demonstrated the merit of designing for refurbishment, as was successfully 
demonstrated by the repair mission and the subsequent science achieved. The lesson is clear: design 
high-performance systems for operations and maintenance so that success of the mission is ensured. 
Hubble taught the merit of Government/contractor teams working together at the industrial plants to 
solve critical problems. 

Hubble reemphasized the performance requirements/sensitivity lesson, adding the footnote that 
for the high-performance systems, nothing can be left to chance, from design, to manufacturing, to 
operations. Each is as critical as the other and must be pursued with diligence. The previous discussion, 
in conjunction with the following problem matrix (tables A-13, A-14, and A-15), should give a good 
feel for the thermal, structures, and pointing control areas. It is also obvious from the Hubble experience 
that the technology is available to develop highly accurate pointing control systems for large telescopes 
of the future. 

Table A-13. HST pointing control problems. 


Component 

Problem 

Cause 

Solution 

Solar array 

Solar array did not meet its 
disturbance torque 
requirement 

Thermal deformations 
caused energy to be stored 
and releasea suddenly 
throughout the orbit, 
producing large pointing 
errors 

Since the disturbance occurred at 
the two lowest natural 
frequencies of the solar array, 
the pointing system control law 
was redesigned to produce an 
augmented gain at these two 
frequencies and was uplinked to 
the HST computer; this fixed the 
problem, enabling the pointing 
system to meet its specification 

Antenna pointing 
system 

When commanded to certain 
regions of its gimbal domain, 
the motor torque limit was 
exceeded and the HST 
entered safemode 

The cable that provides 
power and data for the 
antenna and its pointing 
system was improperly 
dressed and protrudetf into 
the gimbal space, interfering 
with antenna motion 

The region where interference 
occurred was restricted from use 
in the ground software, reducing 
the allowable gimbal space by a 
few percent 

Reference gyro 
assembly 

Over the course of the first 3 
years of the operation, three 
of the six gyros failed, 
requiring elimination of their 
use 

Electronics failures in wheel 
drives and torque rebalance 
loops 

The failed components were 
replaced by redundant units with 
no effect on system performance 

Reference star selection 
software (ground) 

Stars tracked in the fixed- 
head star trackers were often 
not the correct reference 
stars, causing errors in 
attitude reference and failure 
in finding guide stars 

The ground software used to 
select reference stars did not 
adequately allow for , 

magnitude and position 
uncertainties in the star 
catalog 

The ground software, used to 
select reference stars, was 
modified to take into account 
catalog peculiarities 
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Table A- 14. HST structural problem outline. 

1.0 Metering Structure Joints 

1 . 1 Metering Truss Thermal Instability 

1.2 One-Half Scale Metering Shell Thermal Instability 

2.0 Secondary Mirror Support Structure 

2. 1 Thermal Instability 

3.0 Bathtub Fittings 

3. 1 Flight Focal Plane Strength Failure 

3.2 In-House Development Program Strength Failure 

4.0 Laminate/Ply Control 

4. 1 Metering Truss Strength Failure 

4.2 Fine Guidance Sensor Warped Parts 

5.0 Composite Structure Damage 

5. 1 GSE Impact Loading of Focal Plane Structure 

6.0 Metal Matrix Structure 

6.1 High Gain Antenna Welding Microcracks 

6.2 High Gain Antenna Process Control Failure 

7.0 Honeycomb Structure 

7.1 SSM Aperture Door and Aft Shroud Bulkhead “Dings” and Debonds 

8.0 Metallic Structures 

8. 1 OTA Main Ring Loose Joints 

8.2 OTA Main Ring Attachment Joint Installation Problem 

9.0 Nonmetallic Properties 

9. 1 Unclear Property Requirements 
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Table A-15. HST structural problems. 


Component 

No. 

Problem 

1.0 Metering structure joints 



Metering truss thermal 
instability 

1.1 

Thermal growth of truss out of 
specification 

One-half scale metering shell 
thermal instability 

1.2 

Axial thermal growth of shell out 
of specification 

2.0 Secondary mirror support 
structure 



Secondary mirror support 
structure thermal instability 

2.1 

Unacceptable thermal effects from 
uniform and gradients 

3.0 Bathtub fittings 



Flight focal plane strength 
failure 

3.1 

Failure of fittings during structural 
load tests 

In-house development 
program strength failure 

3.2 

Inconsistent failure loads even with 
continuous fibers and epoxy 
bonded on comers 

4.0 Laminate/ply control 



Metering truss strength 
failure 

4.1 

Failure of cylinder strut to meet 
thermal exposure tests 

Fine guidance sensor warped 
parts 

B 

Numerous warped composite flat 
plate parts 

5.0 Composite structure 
damage 



GSE impact loading of focal 
plane structure 

5.1 

During removal of FPS from 
thermal bakeout, hardware was 
impacted by overhead hoist bracket 

6.0 Metal matrix structure 



High gain antenna welding 
microcracks 

6.1 

Extensive microcracks in weldment 
of 6061-T6 HGA 

High gain antenna process 
control failure 

6.2 

Inability of vendor to build a spare 
component with the exact 
equipment, processes, etc. 

7.0 Honeycomb structure 



SSM aperture door and aft 
shroud bulkhead “dings” and 
debonds 

7.1 

Inspections revealed numerous 
debonds and “dings” 

8.0 Metallic structure 



OTA main ring loose joints 

8.1 

Hollow box section Ti ring had 
loose or missing blind bolt collars 
on joints and component 
attachment 

OTA main ring attach joint 
installation problem 

8.2 

Helicoils protruding above surface 

9.0 Nonmetallic properties 



Unclear properties 
requirements 

9.1 

Inconsistent material properties and 
allowable with contractors; resulted 
in varying number of material test 
samples available 


Cause 

Solution 

Laminate plies perpendicular truss 
axial dimension 

Field splice ring had laminate plies 
perpendicular to axial 

Removed laminate from line of 
action; strut passes through slot in 
ring and clip ties ring to gusset 

Removed field splice; added a shell 
bay 

Uniform motion of forward ring 
moved mirror along longitudinal 
axis; gradients across forward ring 
tilted mirror relative to longitudinal 
axis 

Redesigned mirror support 
structure symmetrical about plane 
of forward ring 

No composite fibers, only epoxy 
between base and gusset sides 

A small business source was not 
able to control processes very well 

Replaced composite fittings with 
titanium ones 

Current fitting designs are not 
amenable to composite fiber/epoxy 
processes 

One ply had been omitted in layup 
processing 

Lax receiving inspections 

Changed fabrication procedure; kits 
with prescribed with preassembled 
parts 

Do not allow subassemblies to be 
adjusted to account for warped 
parts 

Inadequate maintenance and 
inspection of GSE hardware 

Scheduled inspections of GSE; 
kinetic energy analysis of impact 
NDE 

Not clear since material is very 
common, no chill bars used during 
welding 

Contractor lost control of 
processes; a second vendor also 
unable to complete part 

Low stresses, adequate life, and 
proof tests allowed use of cracked 
hardware 

Composite processing is not a pure 
science; a preproduction part was 
used 

Due to size of components and 
difficulty with tooling; also prime 
had poor relations with sister 
fabrication facility 

Aft bulkhead accepted as is 
because of small debonds; aperture 
door was rejected; new flight unit 
built 

Used blind bolts with no preload; 
inability to properly use bolt 
installation equipment; use of 
inexperienced people for less 
profitable programs 

Poorly installed helicoils; use of 
inexperienced people for less 
profitable programs 

Fixed loose collars by welds; some 
were drilled out with new fasteners 
installed; more surveillance by 
quality in these cases 

Driven below surface where tool 
could grip; others were removed 
and new ones put in 

Program failed to specify the exact 
requirements desired for the 
hardware 

Clearly define requirements of 
property and allowables; i.e., “A 
basis” or equivalent versus a 
typical of nonstatistical value 
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VI. SPACELAB 


The Spacelab has demonstrated, in an excellent manner, the concept that a manned/unmanned 
reusable laboratory for the space shuttle can accomplish a variety of scientific missions with low 
maintenance and refurbishment of the basic hardware. The Spacelab has not been without problems 
since it first of all has a manned laboratory module that not only has to have life support, but also must 
be a laboratory with power, thermal control, etc., for running and observing scientific experiments. In 
other words, it is a scientific laboratory, with all that implies, operating in the space environment. Those 
features are not just limited to the manned modules, but include the pallets located in the orbiter payload 
bay, used for remote sensing, etc., of Earth and space and for launching satellites. The system not only 
must be rugged enough to withstand launch and landing environments, but also must operate in zero g. 
In many cases, it must isolate the experiments from the disturbances caused by the orbiter and the crew. 

The matrix (table A- 16) lists some of the problems that have occurred during the program. These 
problems and their solutions were complicated somewhat since Spacelab was built by the ESA and 
operated by the United States. The cultural/communication problem was solved and a highly successful 
program has resulted. 


VII. TETHERS IN SPACE (TSS-1) 


Tethers offer many advantages for certain on-orbit tasks; however, the complexity of the 
dynamics and control problems are great (see the previous discussion). The design problems were 
compounded by the fact that the system could not be fully verified on ground due to the large length, 
vacuum, thermal, gravity gradient, zero g, and other environments that could not be simulated on Earth 
for this large system. 

The one great lesson TSS-1 taught was “always verify even the smallest change made to the 
hardware late in the program and particularly at the launch site.” The changing of one bolt, while TSS-1 
was awaiting installation in the orbiter for launch, without verification resulted in a basic loss of the 
mission (table A- 17). 

A complex mission such as TSS-1 requires extensive planning and crew training to ensure a suc- 
cessful mission. Nothing can be left to chance. This planning and training must start long before the mis- 
sion. In fact, it of necessity should be a fundamental part of the design process, as occurred for TSS-1. 

Another key lesson: utilize the expertise that exists in the institutions and industrial complexes as 
well as Governmental agencies to help understand and solve problems, as well as design issues. This 
was done for TSS-1 and contributed greatly to the solution of the tether problems. 

VIII. INTERNATIONAL SPACE STATION 


It may be premature to discuss ISS problems since it is still in development; however, some of 
the problems that have occurred offer valuable insights and lessons. A major problem has been the many 
changes mandated by the changing economic problems of the United States. Adjusting to the budget 
constraints and redesigning to meet these constraints would be an interesting study within itself, but is 
not included in this report. As the concepts, designs and hardware testing have evolved, problems have 
occurred, particularly in the life support systems, which must function long term in space with minimum 
maintenance and refurbishment. The same is true for the meteoroid debris protection system, which also 
must function in space environments for extended periods. In other words long-term space stations 
require the proper life support for the crew and protection from the harsh environments such as debris. 
In addition to the previous discussion, the matrix (tables A- 18 and A- 19) lists some of these additional 
problems. 
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Table A- 16. Spacelab problems. 


Element 

Problem 

Problem Causes 

Spacelab Module Rack 

DPM has high stress levels for 
(1) MPE-to-DPM mechanical 
assembly (MA) interfaces, (2) 
MPE- to- Spacelab rack interfaces, 
and (3) DPM MA-to-Spacelab 
rack interfaces 

High stress levels due to the 
stiffness and large mass of the 
DPM in lower portion of rack 8 
(especially the MA) 

Spacelab Module 
Underfloor 

Negative margins calculated 

Utility equipment located in the 
underfloor in front of rack 9 is 
heavier than previously analyzed 

Spacelab Module Rack 

Negative margins calculated for 
GFFC front shear panel-to-rack 
interface 

Weight of GFFC inducing high 
stress levels to rack 

Spacelab Module Floor 
Support Structure 

During the roll-in of the floor 
into the module on IML-1, 
interference between the floor 
and floor support structure 
occurred 

Threaded portions of the bolts 
protruded beyond the nut 

Spacelab Module Floor 
Support Structure 

Measurements of the USML-1 
floor showed that the floor 
exceeded the SPAH envelope 

Interference between the payload 
cable trays and the floor 
structure; measurements indicate 
that cable trays exceed the SPAH 
envelope 

Spacelab Emergency 
Breathing System (SEBS) 

According to analysis, the SEBS 
bracket will not carry the current 
loads being applied 

With the IML-1 loads applied, 
the lower position mounting 
bracket would yield, than fail 

CGF Experiment 

CGF size and weight would not 
fit within normal Spacelab rack 
requirements 


AEPI Experiment 

AEPI landing unlatched in 
payload bay 

Latching mechanism would fail 
to relatch after experiment 
operation 

Atlas- 1 Orthogrid Strut 
Gapping/Looseness 

Strut gapping effects not included 
in Atlas- 1 pallet verification 
coupled loads models; MPE 
modal surveys indicated some 
struts had reduced effective 
stiffnesses due to gap/looseness 

Strut gaps result from a buildup 
of tolerances between end 
clevises, clevis pins, and 
monoballs 

Spacelab Rack Overhead 
“X” and “Y” Rod Attach 
Hardware 

Attaching racks to overhead 
support structure is difficult task 

Use of a one-time-only tab 
washer; access area for working 
with washer is severely limited 
and shear carrying bolt is too 
short 

Spacelab Module Rack 

Spacelab rack and rack-to- 
module load carrying capability 
needed to be increased 

Acceleration and load levels that 
Spacelab must withstand during 
shuttle launch and landing 
conditions has increased due to 
revised forcing functions 


Problem Solutions 


Minimum “close fit” interfaces 
were maintained for the 
interfaces between MPE, DPM, 
and Spacelab rack using match 
and drill for MA and epoxy in 
selected slotted holes in the rack 


Used maximum torque on bolts; 
showed friction would hold bolts; 
had redundant bolts 


To obtain a “close fit” interface 
between the shear panel and rack, 
eccentric bushings used in rack 
bolt holes 


Remove the threaded portion of 
the HIGH LOK bolts that 
protrude beyond the mating nut 


Remove the threaded portion of 
the HIGH LOK bolts that 
protrude beyond the mating nut 


A safety strap will be added to 
the SEBS mounting 
configuration to ensure the SEGS 
will not separate from the 
forward and aft end cone 
mounting bracket 

Special rack designed for GCF 
that meet Spacelab rack safety 
and interface requirements 

Dynamic and static assessment 
determined that landing 
unlatched would not be a hazard 
to orbiter 


Dynamic analyses performed on 
VCLA models with struts 
modified per static analysis 
results; minor frequency shifts 
were within established 
guidelines; therefore, VCLA 
models are considered test 
verified 


Modification: supplying correctly 
dimensioned bolts, eliminating 
the tab washers and replacing the 
nuts with steel lock nuts 


Strength improvement to module 
rack-to-rack and rack-to- 
overhead support attachment 
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Table A- 17. Tethers in space problems. 


Component 

Problem 

Problem Cause 

Problem Solution 

Tether 

Skiprope 

Tether current flow interaction 
with Earth’s magnetic cause 

Observers, orbiter yaw 
maneuvers, passive dampers, 
phased current flow 

Tether 

Skiprope observation 

Need for intelligence about 
skiprope for corrective actions 

Satellite attitude data to input to 
Kalman filtering and fast Fourier 
transform techniques 

Tether 

Libration 

Interaction between Coriolis and 
gravity gradient forces 

Smooth and continuous reeling 
command profiles, observers and 
crew techniques for intelligence 
for orbit translational maneuvers 

Tether 

‘‘Bobbing” tension oscillation 

Interaction between endmass 
accelerations and stretch of the 
tether 

Minimize thruster firings and 
active damping through reel 
motor back EMF 

Satellite 

Satellite attitude oscillations 

Interaction with tether tension 
and slack tether, through modal 
interaction and endmass 
movement, thruster 
misalignments 

Satellite attitude reference, active 
automatic and manual rate 
damping by thrusters 

Structure/level wind 

Interference 

Inadequate clearance after late 
modification 

Redesign for clearance 

Tether/guide pulleys 

Tether jam 

Inadequate tension management, 
lapses in guides 

Improved guides and tension 
management through mainly 
procedural changes 

Deployer system/satellite 

Hazard of orbiter collision 

Deployer hardware failure 
causing uncontrolled reel-in of 
satellite 

Redundant overspeed detection 
circuits to automatically shut 
down reel motor 

Tether 

Hazard to orbiter of tether 
severance and recoil toward the 
orbiter 

Inadvertent severing of tensioned 
tether by orbital debris of 
meteoroids 

Automatic detection of slack 
tether conditions through tension 
monitoring at both deployer and 
satellite for rapid execution of 
orbiter evasive maneuvers 
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Table A- 18. Space station structural problems. 


Component 

Problem 

Rack 

Low fundamental frequency 
(<25 Hz) 

MPLM/rack coupled loads 

High interface loads 

Meteoroid/orbital debris 
shielding for space station 
manned modules 

Inability to meet PNP 
requirements in U.S. manned 
modules without complete shield 
redesign and excessive 
thickening of module skin 


Safety concerns with fully 
assembled international module 
cluster having high likelihood of 
penetration 

1 

Structural design and 
verification criteria 

Lack of common design and 
verification criteria for NASA 
and international partners 

Glass window design 

Sustained stress over 15 years 
due to on-orbit pressure causes 
static fatigue 


Problem Causes Problem Solutions 

Open box construction due to Additional stiffening added to 
crew utilization of requirements rear of rack and utility panel 

made structural, which raised 
frequency to 25 Hz, while 
retaining capability for front 
access 

Rack interface fittings not Aluminum fittings were replaced 

designed to high load levels, by titanium 

which the coupled loads analysis 
discovered 

Growth in debris environment at Redesigned M/D shield 
station orbits employing aluminum plus 

composite sandwich 
construction, integrated within 
existing structure and envelope 
raises PNP back to original 
requirement; verified via impact 
testing to predict protection 
enhancement and thermal 
performance, via mockups to 
verify physical interface with 
existing module structure 

Growth of debris and exposed Developed analytical tool to 
size of module cluster taken as a quantify and maximize crew 

survivability following orbital 
debris penetration; verified via 
internal module impact effects 
testing, hazards effects analysis, 
including cooperation with DOD 
in crew survivability; 
implemented improved crew 
operations with JSC astronaut 
office and Russian station 
partners 

Multinational program managed Common criteria developed by 

by three different NASA field NASA and contractor teams led 
centers by senior NASA managers 

• Structural design and 
verification 

• Fracture control 

• Window design and verification 

Moisture content of ambient air Conservative fracture mechanics 
causes stress corrosion effect in methodology employed in 
glass microcracks under stress window design 

NASA/FLAGRO updated with 
glass equations 

Proof testing of each pane 
required to screen initial flaws 
larger than those assumed 

Windows designed such that 
tension is not on inside surface of 
the pane (damage tolerant) 

Cavity between primary and 
redundant pressure panes vented 
to space to reduce exposure to 
moisture 
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Table A- 19. Space station ECLSS problems. 


Element 

Problem 

Problem Causes 

Problem Solutions 

Hab element 

Incomplete waste water chemical 
constituents for ground testing 

Ersatz mixtures utilized for 
certain waste streams 

Use of “real” waste water sources 
when available 

Hab element 

Water system not completely 
sterile prior to testing 

Microbial growth in test systems 
(particularly in plumbing dead 
legs) 

Elimination of plumbing dead 
legs, sterilization of system with 
hot water at 250 °F 

Hab/Lab element 

Cyclic variations in cabin 
temperature, C02 partial 
pressure, and dew point 

C02 removal subsystem return 
air exhausted into cabin 

C02 removal subsystem exhaust 
routed to upstream of condensing 
heat exchanger 

Hab/Lab element 

Entrained water generated 
upstream of C02 removal 
subsystem 

Silica gel breaks down when 
subjected to liquid water 

Modify C02 removal subsystem 
by adding layer of Zeolite 13X™ 
upstream of silica gal 

Hab/Lab element 

Trace contaminant control 
subsystem (TCCS) plumbed 
downstream of C02 removal 
subsystem 

Trace contaminants removed by 
C02 removal subsystem rather 
than TCCS 

Plumb TCCS so that cabin air is 
pulled directly into TCCS 

Hab element 

Overall system complexity, 
component redundancy 

Separate loops utilized for 
potable and hygiene water 
reclamation 

Potable and hygiene loops 
combined into single water 
reclamation loop 
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